oh i completely missed this,
Let me explain you

WE as the application steemautp.app needs to upvote , post and claim rewards on your behalf. so we need you to give us your posting authority that allows us to do all those operation , but in the blockchain level if you want to authorize any app or revoke authorization the app you need to sign a transaction which requires your active key . This does not means that we have your private key access . We have your posting authority on the blockchain level that is provided to us by steemlogin which is a frontend that makes it easier fo us and you to sing any type of transaction on the chain .
Steemlogin will no way save your keys nor we will

and yes i am not #block.token or @aceh.point

thanks @futureshock for your wonderfull reply