Custody is who can move your coins

The chain does not care what the app says you own. It cares who can sign a send.

If someone else can move the coins without you, they have custody. Your password is access to their books. It is not the key on the network.

Write this down: custody is control of the keys, not the logo on the screen.