Sparrow is software based. You generate your keys on that computer. If your machine is compromised then so are your keys. You can just sign transactions from the app.