@micahlt I just realized you have both my scratch and wasteof password from itchy and wasteof mobile both of which I use via a emulator on pc
He might not send your password to his server, he might just have the token on a file or something. I don’t think he would do that. Can’t confirm, though
You're right! Only tokens are stored, and they're only stored locally!