Two main questions which users ask us:
Why outcoldplayer does not use OAuth?
Google does not provide official API for Google Play Music and we just do not know how to do this, because we cannot register our application for this service.
Does outcoldplayer keep all accounts and password in safe place?
We use username and password only to get Tokens and Sessions keys, after this if you will set "Remember password" we will keep it in special storage for passwords (Windows 8 provides us this capability, it is very similar to how Internet Explorer stores passwords) and we do not use it until Google revokes previous Tokens (we store tokens between application starts).