The privacy policy of not storing passwords is nice but what about when they get hacked and the site starts uploading passwords to some attacker's website?