It's easier if you think of it as a "signing device" and not a wallet. The app sends the transaction to the device, the device signs it with your private key, and then sends the signed transaction back to the app. Your key stays on the device. The app creates and then broadcasts the transaction to the Bitcoin network. Your "coins" are on the blockchain, your private key proving ownership.