xHitbox uses WebAuthenticationBroker for login function, and doesn't have access to password user types in login screen, all it gets out of the authorization is an access token from hitbox.tv.
Information xHitbox stores locally
xHitbox stores user setting and the access token locally on the device it is running on. User can revoke the access token anytime by visiting hitbox.tv account->connections->connected apps.
Information xHitbox transfers out
xHitbox doesn't transfer any private information out of the device it is running on.
By using xHitbox, you signify your acceptance of this policy. If you do not agree to this policy, please do not use xHitbox. Your continued use of xHitbox following the posting of changes to this policy will be deemed your acceptance of those changes.