Stored only in this browser tab's session storage (cleared when the tab closes). Never sent anywhere except this app's own backend, which relays it to Freshservice for each request.