Authentication is performed through Reddit oAuth2. Your password is transmitted through Reddit infrastructure and we do not have access to your Reddit account password. We cannot perform actions on Reddit on your behalf.
We request the identity permission to see your username.
We request the read permission to check that you are a subscriber of /r/lockpicking and are not currently banned or muted.
We request the flair permission to see your user flair on the lockpicking subreddit.
If in doubt, here is the authentication code transparency.
We do optionally collect your name, email address, and shipping address, but only if you submit the information. Your email address and name is not currently used anywhere within this system.
Your mailing address is only visible to you, someone who has your lock (for sending it back to you), and someone who has a lock that you're next in the queue to receive (to send it to you). Your address is stored as an RSA encryted binary bytestream for your protection.