When you choose password login, HourIdler stores the Steam password encrypted at rest. The service can decrypt it in memory to authenticate when needed. Session tokens and Steam Guard secrets are also encrypted at rest. The operator controls the service and its keys; encryption does not make credentials inaccessible to the operator.
QR login provides a token without sending HourIdler your password. Removing a connected Steam account deletes its stored login material. See the privacy and retention policy for whole-account deletion and the recovery window.