You are right to be cautious about your credentials, I made few post talking about private keys on Steem, here and here and mentioned on my posts how eSteem handles security very seriously... At Login, all your credentials are stored on your device, nothing gets out. Every transaction is signed locally and only transaction hex is broadcasted through websocket address you choose (Settings page). We have also added extra security measures by introducing PIN code system, where you can keep app data secure. With that said, I am working on FAQ and will have it on http://esteem.ws as well point users.