I wouldn't trust a website that wants your username and password.

I don't store your password if that's what you're asking! I'm planning to make it open source once I make sure I didn't accidentally leave any production secrets in the code.

Anyway, here's how it works:

• You log in using your account, the site checks whether it's a valid account using api and if it is, it creates a JWT token that's used to authenticate you against Lemmy. At this point your password is already forgotten and the site has no way of getting it.
  • The JWT token is effectively the same as having your password - it allows you to do the same things you could if you have logged in normally.
• The JWT token is not stored on the server, it's only in a cookie in your browser.
• When you schedule a post, the post details, your instance, your username and your JWT token are stored in a job that gets scheduled to run later. This is the only part where any sensitive information (JWT) about you are stored somewhere else than your computer.
• After the scheduled job is triggered, it authenticates as you and creates the post as if it were you, immediately afterwards the job config is deleted, meaning the JWT is no longer stored.
• The JWT is stored in every scheduled post you make, meaning as long as you have any scheduled post, the JWT is stored somewhere. When all scheduled posts are posted, your JWT is no longer present anywhere on the backend.
• Note that due to current technical limitations, even if you cancel a scheduled job, its config (including the JWT) is stored until the original scheduled time. This will be (probably) fixed in future versions when I have some time to work on it.

Hope it clarifies it, let me know if you don't understand any part of it!