Usually the websites and apps you use, but not what specific page you visit and it’s content.

If you for example visit https://en.wikipedia.org/wiki/Labor_unions_in_the_United_States they could see that you visited https://en.wikipedia.org/ but nothing more.

This is assuming that the website is encrypted (it starts with https://, not http://), which nowadays luckily most websites are. Otherwise they can see the specific page, it’s content and most likely also all information you input on that page.

They recently announced that they will publish new exploits at DEF CON next week and recommend owners to not update their firmware if they want to take advantage of that.

So depending on how the exploit works installing Valerie might get a lot simpler. It usually takes quite some time until such exploits are not only fixed, but then also for devices with fixed firmware to hit the shelves.