It -should- be on a server somewhere, considering stuff has to be server side for validation etc (the same reason hacking screwing rankings are a big no-no)
The games, like most modern Squeenix mobage offerings, probably identify by device and sends you your account info automatically, rather than a login system. Tying a device to facebook is how you let the service know multiple devices belong to you and to send you your account information to all of them (since presumably you'd log in to facebook on all of them or something)
I'm pretty sure you'd hardly be the only case screwed over by an update going south. Hopefully they find a way to validate with you which account it was. Stuff like friend code, name, last login date, etc.