What data can Kohai access through connected apps?

Only what you approve on the provider's own consent screen when you connect the app. Sign-in always happens on the provider's site, so Kohai never sees your password. Connections are per-user: your connected accounts are used only by agents acting on your behalf and with your approval.