Yes, the keys are controlled by the wallet locally on the app. The third party here is the Mycelium servers that store the blockchain these wallets rely on. The only thing our "third party" does is fetch your wallet's balances, broadcasts your wallet's transactions, and some other minor administrative stuff. It doesn't control your keys in any way, and at worst can break and make your wallet stop working, in which case you would just move your keys to a different wallet.