What do you keep about my account?

Only what logging in and your purchase history need.

Email accounts: the email in lowercase and a scrypt hash of the password, never the password itself. Token accounts: a login hash of the token, the token's final 4 characters, and a single encrypted copy that exists only so top-ups find the right account. On top of that, each account carries its balance, payment history, pass dates and a hash of the IP it signed up from.