Just clarifying - this isn't how it works. Usernames and passwords may pass through my servers, but they are not logged or stored. When a token is received from Scratch or wasteof, that token is transmitted back to the user's device where it is then stored.