Where is my code stored?
Only in your browser's localStorage. Nothing is uploaded, so you will not see it from another device or browser – and clearing your browser data clears the code too. To keep something, use "Download HTML" to save it as a single file, or create a share URL if it is under 4KB.
Can I load external libraries such as jQuery?
Scripts from cdnjs.cloudflare.com and cdn.jsdelivr.net load fine. This page's Content Security Policy is inherited by the preview, so scripts from other domains are blocked. Images, web fonts and stylesheets can be loaded from any https source.
Is the preview safe to run?
The preview is an iframe sandboxed with allow-scripts only. Because it is not given allow-same-origin, scripts inside it cannot read this page's cookies or localStorage. The console pane simply displays messages the iframe sends out with postMessage.
Can I turn off the automatic refresh?
Untick "Auto update" and nothing re-renders while you type; press "Run" when you are ready. That is the safe way to experiment with heavy loops – and if a preview does hang, only the iframe is affected, so turning auto update off and fixing the code recovers it.