Regarding data, Design Tools does not require the use of any student information, so it does not store any user data. It also does not store any course content. All content created with the tools is written as HTML into the Canvas RCE and stored as HTML in Canvas. Additionally, user information and authorization is all managed by Canvas. Design Tools stores an encrypted developer key that you provide upon installation (click here for more information about the installation or here for more information about the developer key and OAuth tokens) and encrypted OAuth credentials for those who use the LTI tools.
As mentioned, Design Tools does make use of the Canvas API. You can read a detailed description of what APIs it uses and why here.