What leaves your browser, and what never does
Field names travel; field values do not. Passwords and card fields are never read at all.
What is sent to plan your task
Your message, and a structured outline of the page: what each control is, what it is called, whether it is required. That outline is what a plan is built from.
What is not in that outline
The values. The planner is told there is a box called “Email”; it is never told what is in it. That is why a long form sometimes needs a second round — a field it just filled looks exactly as empty to the planner as it did before.
What is never read at all
Passwords, card numbers, security codes and one-time codes. These are skipped where the page is parsed, before any data could leave it — not filtered later, not redacted, never collected.
What is kept
Run counts, and step counts, timing and success rates tied to a site's domain pattern — so support for a site can be improved when it starts failing. Not the address of the page you were on, and not what was on it.
The full detail is in the Privacy Policy.