For password storage, if you're on mac it uses keychain access and if you're on windows it uses windows password manager.. it's all controlled by openapi and only stored locally. Nobody but you on your own computer has access to any passwords and even then they are encrypted until you unencrypt them yourself using keychain access or windows password manager tools. Also like eric said, it's open source so you can see exactly what it's doing if you're that curious.