Their backend is really, REALLY garbage. Maybe it is some of that Microsoft trash that they snake oil’d into a lot of public offices and dumbass corpo managers, but whatever is running that site, has me concerned. You don’t do fucky things with passwords unless your backend is doing something really stupid.
I have an older Samsung Tizen device – you don’t have to worry about privacy because the piece of shit has basically 0 servers to connect to and most of the time if you set a DNS server manually it will completely fail to connect to the internet anyway