I don't think that's correct. They state that passwords are decrypted in the browser. They are stored encrypted on their servers but not decrypted on their servers AFAIK