While I appreciate their honest and upfront response to the question, I'd argue this makes the idea better suited to an application that the user runs locally.
The use of the word rederive sounds like it may be encrypted to me.
So yes, they can and most likely do encrypt it in some way, but in order for their server to be able to decrypt it when using it, they must naturally have to have the decryption code/passkey/etc stored on the server.