Only xs and t are sent. Even if a hacker intercepts the data, without knowing the exact sensing matrix used to produce xs, he/she cannot reconstruct the original signal.
In this demo app, data between the sender and the receiver is transmitted via the HTTP POST protocol.