For unlocking, the data will be stored on the Phone's secure enclave which is locked with your passcode. They say they won't upload it to their servers (which you have to trust them on, because it's hard to see if they do it).

However, there's an API for this tech as well and apps could abuse it. I bet they'll introduce a permission request for this though.