which browser API is used (indexedDB?)

All of this is built on top of async-append-only-log, this in turn uses polyraf, which is a wrapper around random-access-storage family of libraries so that it works both in the browser and in node with the same api. In the browser it will use random-access-web which for firefox will use indexeddb but for chrome will use a special faster backend.

how is the private key stored

It's stored in localstorage.