They need your cleartext pw in order to create a config profile and that's it. Why would they need to store your pw at all? Once the config profile is setup, the IMAP AUTH request gets proxied through them to the original provider and handled as normal. No need to store any pws at the proxy.
