I didn't down vote you, but in any case, that's not what I said. I should have been clearer, my bad.

I said we'd store the user's key in local storage referring to the user's randomly generated key our client uses to encrypt data before sending to the server.

Passwords are never stored in plaintext anywhere. We don't even send passwords to the server in plaintext -- we hash passwords client-side.

But yes, even storing the key in plaintext in local storage has undesirable properties, which is why it's opt in. But an app that encrypts data with a key stored in local storage has a significantly higher level of privacy than an app that sends all data in plaintext to the server for storage.