Data is stored in a database which is located inside the app’s secure private data folder. No other apps can access this data (unless your device is rooted). Pictures are, since version 9.4.4 of the app, also stored in this folder.
If you use synchronization, your data will be stored on either Dropbox’ or Google Drive’s servers. You can delete all cloud data if you want to, see Deleting your synchronized data.
Recommended read: Notes’ Privacy statements.