I have a small app hosted on pythonanywhere. Can an outsider get all the sensitive data from my db?
Is pythonanywhere protecting against attackers?
Data stored on your PythonAnywhere account is basically as safe as the account itself.  So as long as your credentials are not compromised, you can assume that no outsider has access to it.  If you have a web app, users have as much access to your data stored on your account, as you expose it via the web app and the code visible in the browser.
Can an outsider get all the info from a database on pythonanywhere?