No worries! When you submit your username/password in Thunder, that information gets sent directly to the instance that you specified (e.g., lemmy.world)

The instance then responds back with a success/error depending on whether the username/password combination was correct. When the instance sends back a response, they also send what is known as a token. This token is not your password, but is used as a way to perform actions on your behalf. That token is stored locally on your device so that your actual password is never stored!

When you remove your account from Thunder, that token that was saved on your device also gets deleted.

That’s the basics of how it works, hopefully that makes sense