This way a third party has your private key which is a big no no. they can just input private key and withdraw from your wallet.
No, split-key generation is being used here. Properties of elliptic curve cryptography allow you to keep a private key, and provide the vanity searcher the corresponding public key. They search until their hash(their public+your public) has the right prefix in base 58, then they provide you the private key they found.
You then combine their private key half (which they provide to you) with the one you kept secret.
My mistake I see now that is does use that. thanks for pointing that out.
