Where are my login and connection passwords/tokens stored?

Connection secrets are kept in the macOS Keychain, never written to disk as readable text. Your Supernote login is held as a normal session cookie inside the app. Tokens for connected to-do apps (a Todoist API token, or your Google or Asana sign-in) are sealed using macOS's secure storage and saved as locked files in the app's "credentials" folder — the plain token only ever exists in memory while the app is running. If secure storage isn't available, the app refuses to store the token rather than save it in the clear.