My understanding is it’s a risk but can be avoided.

Web client use nostr:npub1getal6ykt05fsz5nqu4uld09nfj3y3qxmv8crys4aeut53unfvlqr80nfm

Android has key storing apps I believe.

#asknostr too for help