Nice to know that you use Itchy! Actually, both of those apps do not store your username or password anywhere. The way the flow works for wasteof.mobile is sign in > password goes to jeffalo's server > returns a token > app locally saves token. Itchy is similar, but requires an external server for technical reasons. Its flow is sign in > password goes to proxy server > password goes to Scratch > proxy gets token > app saves token locally. I appreciate your concern though! Neither of the apps even use a form of analytics - I know how important privacy is to people :)

Idt those collect the passwords tho

He might not send your password to his server, he might just have the token on a file or something. I don’t think he would do that. Can’t confirm, though