Aqua stores:
- Message text (both plain text and html) in internal memory, not accessible without rooting
- Attachments are cached on the "memory card", which these days, is not a memory card at all, but is a partition on the same memory chip... but accessible without rooting
- Passwords are stored in internal memory, not accessible without rooting, and also encrypted