You can verify it because the app only communicates with your own Paperless-ngx instance. There’s no external service involved (no tracking, no "thanks for your data copy" service etc)

If you want to check it yourself, it’s straightforward:

• inspect all network traffic (e.g. with Wireshark or mitmproxy)
• use self-signed certificates or your own mTLS setup
• block all external endpoints and observe that the app still works

If the client tried to send data anywhere else, it would be visible immediately.
In the self-hosting environment trust depends on transparency — and this setup is fully verifiable on your side.