what happens to our sign up data / how secure is it? I

As secure as I can make it on a shoestring budget. Basically unless we get targeted by a nation-state, you should be fairly secure. If OpSec is a concern, I suggest deleting the account and making one on a VPN using a throwaway email