The app can get a hold of your passwords and payment details.