Everything runs in your browser. The key is only used as the new token's mint.
How vanity addresses work
A vanity address is found by generating random keypairs until one matches your pattern. Each extra character makes it roughly 58 times harder, so we cap it at four characters. The search runs in Web Workers in your own browser, so no secret key is ever sent to a server.