But the app owner can't really control the userfunds like he controls his own funds in his dashboard right ? The only way he could "control" it is by tipping it to himself or whereever with some malicious code or stealing the token/cookie and gain access to his account, or am I missing something there ?
