Thanks!
It only uses publicly available information from the blockchain, so a password/private key is not needed. When you login to your account via the built-in browser, the login cookie is stored on your device (like Safari would).