"May be able" refers to collect, which is entirely up to the app. It does have access to password as you write them with it. It doesn't know what you're writing and it MAY collect. But it's not clear if it does collect.
But does it have network access, or access to other apps (perhaps via shared storage)? There's no reason for it to have any of that, and there exist systems for tracking whether an app can do those things.
