Does the mobile app run completely on the device or do eM Client‘s servers doing the mail management for me and thus get my credentials?
The Android and iOS app is installed locally on your mobile and tablet devices, and then like the desktop verify messages to and from your Mail server via OAuth secure tokens and encrypted passwords.
Suggest to read the eM Client blog on how the Push mail messages are handled using your credentials.