How does the app see my Supernote to-dos — do I give it a password or token?

No password or token is ever copied out. When you sign in, the app shows Supernote's real login page inside the window. After that, it reads your to-dos by asking the already-logged-in Supernote page for them, using the same session your login created. Your login stays put between launches, so you normally only sign in once.