Why is the pubkey "hash" sent to the server as a query, rather than staying client-side as a fragment? Why does "Regenerate Private Key" not actually regenerat

Why is the pubkey "hash" sent to the server as a query, rather than staying client-side as a fragment? Why does "Regenerate Private Key" not actually regenerate private key? Why is the pubkey obfuscated by encrypting with "123NSA"? How do I know the 624-byte pubkey "hash" doesn't contain the 32-byte private key? How do I know the server isn't secretly harvesting IP addresses, associating them with pubkeys, and crawling referrer URLs for messages?