Is connecting Google Tasks safe — what can Relay see?

Yes. Relay's Google sign-in has passed Google's verification review, so you get Google's normal, clean consent screen. You're only granting access to your own Google Tasks (and, if you turn on note upload, files Relay itself creates in your Drive — never the rest of your Drive). You can review or remove Relay's access any time at your Google Account → Security → "Your connections to third-party apps & services".