Boxee code is used to query Giant Bomb API; they return back your API key for your account. This API key is used to get information from Giant Bomb API. No account name or password is involved.
Premium Podcast RSS requires you to authenticate using your Giant Bomb premium account. Your user name and password are managed by Windows, not the app itself.
Some settings will roam across devices, such as your watch history (which can be disabled in options) and your Watch Later list. Roaming of these files is managed by Windows, and nothing is sent to the developer other than anonymous crash reports through Microsoft.