Given the recent exploits of other popular web services, I'm curious to hear a bit more about your security model. The privacy policy makes it sound as though all non-credit-card info is transmitted and stored in plaintext.