Since online accounts are needed to use the app, I think it would provide a bit more safety if there was the option to have multi-factor authentication using an Authenticator app and/or hardware key. You can also provide static reset codes in the case of a lost device/hardware key.