Always a great start sign when some one says that. I'm sure they even rolled their own database structure and user account storage. I mean how hard can securely storing user passwords be?

I bet if you can find the API key, then it will allow access to everything.

(Actually after reading it, it's worse, it literally sends people's app PINs in responses.)