When you register we store a username, a display name, your email address, a password hash (we never see or keep the password itself), your interface language, and an avatar and bio if you fill them in.
Signing in with Discord, Google, Steam or X stores only your id and handle at that provider, so we can recognise you next time. We do not request your friends, messages or anything else from those services.
Between the two steps of a sign-up we hold your username, display name, address and password hash for ten minutes, then delete them if the code never comes back.
A six digit code is delivered by Resend when you create an account or recover a password: it receives your address and the message with the code, nothing more.