So never put passwords, keys, tokens or customer credentials in a question or an answer: give SyncNow a password only in Connections.
As a safety net, the server checks every text before saving it: a recognizable key or token, such as a private key, an API key or a web address with a password in it, is refused and nothing is saved, and a password already in the project's vault is replaced by a placeholder. This recognises patterns and known values only, so a secret it does not recognise gets through, and deleting a question erases its text only when it is removed for good, 30 days later or at once with Delete permanently, while the server's event log keeps its subject line: if one got through, treat it as exposed and change it where it is issued.
The project's history and Activity keep a question's id, subject, who asked and answered and its priority, never the text of a question or an answer. SyncNow itself does not pass questions or answers to an AI service: routing and the duplicate checks are word matching on its server, and only what someone saves as a plan or a rule goes through the usual AI check, with secrets removed. Of Conversations, your PC keeps only the time SyncNow last checked for answers to your questions. See Can I write my database password or API keys in a rule?.