As others have mentioned, it is difficult to trust a developer from an area with cyber-issues (not forgetting for a moment US issues).
Suggest they submit their application to a reputable security firm (Kasperski?) for evaluation and certification. With this issue addressed I would be much more comfortable using for the intended purpose.
Not SAIC user about ВКармане: кошелек, документы