This add-on only ever communicates with the Google Tasks API. All communication is encrypted.

All of your tasks are stored locally, in your Thunderbird profile directory. If you want to wipe all data saved by the add-on from the machine, first clear local data and authentication tokens in the add-on's options, then delete the folder google_tasks_sync from your Thunderbird profile directory.