Yes and no. They may not have your password in plaintext, but they have enough to potentially guess it and verify that guess (i.e. offline brute forcing).
WPA2 authentication is performed through a four-way handshake. Instead of just sending your password in plaintext to any access point you connect to, this handshake ensures that unless both parties already know the password, the password (or any attempt at it) is not revealed. However, enough of that four-way handshake can be recovered to make offline password cracking possible.
Please understand you risk this every day. The network manager on your computer/device is probably configured to automatically 1) search for familiar access points by sending out beacons (thus advertising what is familiar to it and essentially how to mimic it) and then 2) automatically connecting to any familiar access points that responds. Even if you are currently connected to a wireless network, an attacker could disconnect you via a deauthentication attack and then lure your device into connecting to their honeypot.
What can you do to protect yourself?
- Chose a password that is tough to crack.
- On your device, disable automatic connections to so called "familiar devices".
- Refuse to connect to wireless networks with weak passwords.
- Friends don't let friends chose weak passwords.
- Stay away from any WEP or unencrypted networks. Seriously.
If you are interested in 802.11 (aka WiFi) security, check out Vivek's "WLAN-Security-Megaprimer" on SecurityTube. There is a lot of FUD and misinformed articles on wireless security, but the material of Vivek Ramachandran and (when you're ready to try attacking yourself) the documentation on the aircrack-ng wiki are solid. I can not recommend Vivek's material enough. Also, this article on the security of WEP, WPA, and WPA2 seems promising.
You are doing a great job thinking about security and asking the right questions. The next step is to attack yourself. Remember to stay paranoid.