Your key is stored only in this file/tab's memory, never sent anywhere except the provider's own API — but since it's saved as plain text in the page, don't upload or share this HTML file publicly with a key already filled in. If you ever do, revoke and regenerate it from your provider's dashboard.