The cool thing is I can tell no one has actually withdrawn the sats yet (at least of this time stamp). And they return to me if they don't go through with it.
The less cool thing is I believe recipient has to enter a mobile to authenticate/create first use of the web app... though I'm confident (enough) the devs aren't using or saving that for any other purpose and most precoiners don't care.