Not all apps will want to have a good level of session security (as of today). But there are enough that do.

We have a self hosted version that uses your own db to store tokens. So you don't need to give us any "user data".