When signing in to a Mastodon instance, FFDJ registers the application to the instance and stores the authentication data on the server. While user access token is generated on the server, it is not stored.
When signing in to a Misskey instance, only instance address is sent to server, and the authentication data and access token is not stored.
An access token is stored in your browser after the authentication is completed.

When scanning your timeline, no information about the posts on your timeline is sent or stored on the server.
After music links are found on your timeline, an unique ID of the song is sent to the server and may be shared with third-party music services (such as Apple Music or YouTube)
Unique ID and metadata of the music link may be saved on server, in an anonymous way where it is not linked back to the FFDJ user or the post author.
Scan results are stored in your browser after the scan is completed.

Album art or thumbnail image is loaded from music links found when reviewing scan results. Since image loading involves third-party services (such as Apple Music or YouTube), request logs might be retained on those services.

You can connect your Apple Music account to play music links directly in FFDJ. Authentication data is not sent to the server and only stored in your browser. Musics you play with Play button are shared with Apple.

Music links you save are stored in your browser.