This OAuth client is used only by its owner, with rclone running on the owner's own computer.
Google Drive data accessed through it stays between Google and that computer. Nothing is collected, stored on any other server, sold or shared with anyone. The access token is kept in the local rclone configuration file.
Access can be revoked at any time at myaccount.google.com/permissions.