Pretty good disclosure text. There are much bigger companies that don’t manage to be this clear.

The only nitpick I have is saying “encypted” with bcrypt, even though they clearly know that bcrypt only hashes things.