So, the website is essentially an HTTP interface for managing an MQTT broker. You create an account, make a "room" (application concept, not part of mqtt), and then put your account name and the room secret phrase into the device (it throws up a captive portal). The device then uses these to connect to the broker to an MQTT topic that's sha256(secret) and from there it's just simply passing messages between devices.