We temporarily store IPs, usernames (if an email is used instead, then the email) and the site’s domain to do efficient lockouts. This info is not used for any other purposes. The plugin doesn’t send passwords to the cloud. Any information can be deleted if requested.