That's exactly how it works. You can claim a lot of the day is long when the app is closed source

Nonsense.

The app is closed source. Facebook could be copying all your private keys to their servers and you would never know.