The Salesforce Flow Extension does not handle or transmit sensitive information about the user.
It only communicates with Salesforce passing the flow id (extracted from the current page URL) to request flow metadata to display on the screen.
Nothing else is sent to any other server.
The source code for the extension is available at https://github.com/Fernando-Fernandez/SalesforceFlowExtension