> perhaps it's using some encryption key that never leaves the device
Don't they support multiple devices already (running the client on both a phone and a tablet)? Maybe they don't want to have this run on a desktop (either via API or JavaScript), because then curious people might reverse engineer it. Sort of like how Netflix has clients on locked-down Linux-based devices but doesn't support Linux desktops.