Passwords are never stored as plain text — they're hashed before they touch the database, so nobody, including us, can read a password back out of it. A session is issued when you log in and used to recognize you on later requests; logging out clears it.
The tools (ScottPDF, ScottIMG) do as much processing as possible directly in your browser. Where a file does need to reach the server — a conversion the browser can't do on its own, for example — it's kept only long enough to produce your result and removed afterward, not kept around in a permanent file store.
Anything you post publicly (a comment, a forum thread, a reaction) is visible to other visitors, same as any public comment section. Treat it the way you'd treat a comment on any other public site.
ScottVentures is a small, independently run project, not an enterprise platform, and it's worth being upfront about that. A few things that a larger service would typically have in place are still on the to-do list here: formal rate limiting on login attempts, a published responsible-disclosure process, and a security audit by someone other than the person who built the site. None of that changes how passwords are handled today, but if you're deciding how much to trust the site with, it's fair context to have.
If you spot something that looks like a security issue, please report it from the contact page rather than posting it publicly in the forum or comments, so it can be looked at before anyone else finds it.