The first thing that immediately caught my attention is that it's not using HTTPS by default. More specifically, login and signup are both performed without it. Personally, I won't sign up for or log in to a site that runs sensitive information over a plain-text connection. Changing the protocol manually gave me a warning that the certificate expired at the beginning of September, so maybe that's being worked on.