Tor  works by routing your connection through a chain  of servers around the world. The servers are called nodes. Your  data is encrypted until it reaches the last node, or the "exit node". It is then decrypted so it can be sent to the site. This exit node can capture anything you send to a website if you are not connecting via an SSL connection. The first node in the chain  knows who you are, but not where you are going; it only knows to send your encrypted data  to the next node in the chain. The middle nodes don't know who you are or where you are going; they just send the encrypted data they get to the next one in line. The exit node knows where you're going and what you're doing, but not who you are; it  sends the data back through the chain to the node behind it.  

Anyone can set up and run a node, including an exit node.  The problem is that you don't know who is running the exit node you are using and what their intentions are. But if you understand this and don't send sensitive data over Tor, then it works very well and does what it says it does. I wouldn't do it for what you are suggesting though.