It doesn't appear so, no. The raw bytes seem to be dumped to temp files, local storage, or S3 [1][2] without mention of any sort of encryption step (or reading of a secret somewhere). As mentioned below, you could encrypt before uploading of course. Someone please correct me if I misread though.

[1] https://github.com/dutchcoders/transfer.sh/blob/master/trans...

[2] https://github.com/dutchcoders/transfer.sh/blob/master/trans...