If I was personally in charge of the app, I wouldn't deem it safe at all. I would have written an area to either be copied once, or a password-protected area, so it can be retrieved it via the website. I had a client.. I asked her for her Paypal email address so I could link her website and Paypal together so she can start making money on her products. She sent me all of her bank information. I warned her that she should not do that. Should my email or hers ever be hacked, or if I was someone who happened to be a scammer, she could have been out her entire savings. I have since deleted the email. There are just some things you don't do. And the last thing I want is her bank account information in my email. I've never had issues with my email being hacked, but I wouldn't want to be responsible IF anything ever did happen.
It reminds me of those websites that send you your password directly without encryption or anything. I also make it a point to send a user, who forgot their password, an actual link to reset their password through the website. If they forgot their old password, they must have not wanted to remember it, and it is technically not our responsibility to remember their exact password. Of course, I could probably get the system to send them their unencrypted password, but I think it is unsafe practice. Instead, I just send a link that takes them to a page where they can change it completely.
As far as personal information, that stays within my https website, either in invoices stored on the website or a single printable page that shows the transaction occurred. A person can easily save it or email it to themselves [at a later time], but that is an option I provide in which they are responsible for the information in their email now, because they personally had to click a button to have it sent there, rather than me automating important personal information to their email.
My responsibility is to provide the product and make sure it works for my clients. As far as payments go, I put that on a payment processor and I never save that information, so in essence, the most information I have is: account information and the fact that a transaction took place. That is the best way to increase your security is by keeping minimal information and simply not having to be the one fully responsible for it at all.