Personal scripts has a single user: the owner of the Google account it signs in to. Nobody else can sign in to it.
With the owner's consent, it reads and updates the owner's own Google Calendar, Drive, Sheets and Slides, and reads the billing, monitoring and BigQuery cost data of the owner's own Google Cloud project.
The data is used only by the owner, for their own purposes, on their own computer. The scripts send it nowhere except to the owner's own screen and files. It is not sold, not shared with third parties and not used for advertising.
The sign-in token is kept in the owner's operating-system credential store on their own computer. No data is stored on any server run for this app; there is none.
Access can be revoked at any time at myaccount.google.com/permissions.