Yes, thats right, the emails are stored in plaintext in the database. The database has the row level security rules configured so that users only have access to their own data.

It uses Resend transactional API which, based on their docs doesnt store the contents after the email is sent.