I would like to assume there is no ill purpose as well. Login info being encrypted between the app and client so the app creator can't use it would be nice, however how would the gw client use encrypted info? It needs the proper email, password, and character name strings afaik.
I know its kind of a 'hope for the best, but, assume the worst' type situation and judging by the reviews it isn't getting used by many. I know I won't become one of those few, it just seems too fishy and risky.