Account information including user name, instance domain name, and OAuth token is stored on the device in a file named settings.json. When you delete this app the account information is destroyed.
Photos are stored on the device and posted to the Fediverse. A setting allows for photos after posting to be deleted, moved, or copied to the Android Pictures folder.
Sharing photo location is optional. The latitude and longitude is extracted from the photo using ExifInterface only if you have choosen to store location in your photos. You can configure a status to use latitude and logitude using two format arguments %s.
Sharing a photo timestamp is optional. You can modify the timestamp format using Java's Simple Date Format syntax.
All transmissions are over SSL.