From the source of the app (https://github.com/cloudfuji/kandan), it seems that it doesn't check for authorization -for now-, so be aware that anyone can signup to your own private instance if they know your url and do nasty things like deleting channels.