Accounts are stored on our own server — passwords are PBKDF2-hashed, never plain text. A verification code is issued on registration.