Nice to know that you use Itchy! Actually, both of those apps do not store your username or password anywhere. The way the flow works for wasteof.mobile is sign in > password goes to jeffalo's server > returns a token > app locally saves token. Itchy is similar, but requires an external server for technical reasons. Its flow is sign in > password goes to proxy server > password goes to Scratch > proxy gets token > app saves token locally. I appreciate your concern though! Neither of the apps even use a form of analytics - I know how important privacy is to people :)