Apple support, mac with unencrypted drive
Your data is fully exposed, unless you have specifically encrypted files using a passphrase not stored on your hard drive.

Passwords and Secure Notes stored in the Keychain are encrypted on disk. If you have configured your Mac to require a password on boot, this password is usually also used as your Keychain Password. If this password is sufficiently hard to guess, your Keychain data should be safe.

As you note, your browser's session cookies (those that are are still valid) could potentially be exploited.

You can read Apples official document on keeping your data secure during hardware repair here:

http://support.apple.com/kb/ht3294

Regarding Apple's policy - you can read their Service Terms here:

http://images.apple.com/legal/sales-support/terms/repair/generalservice/Service_Terms_English.pdf

Apple writes that they are not responsible for loss, recovery, or compromise of your data.

That being said, I'm pretty sure that Apple's guidelines for their service technicians make it clear that they are not allowed to, for example, copy of all your images on to a USB pendrive and bring that home with them after work. Depending on your location that would most probably also be illegal. That doesn't mean it can't happen though.