Hi,
ROM is Read Only Memory and you cannot store programs or data there.*
When you first turn on a new device or hard-reset an existing one, the machine is wiped, the main ROM with the operating system (WM5/6 etc) boots and loads, then the device reaches into the Extended ROM and initialises the extra programs and settings (themes, wallpapers etc) that the manufacturer or Network provider has prepared.
When you take pictures, make notes or documents or install programs, these can be either stored in the main memory (RAM) of the device or alternatively on the memory card if you have one. The internal RAM of most PDA's is typically 64Mb or 128Mb, whilst memory cards go from 16Mb to 6Gb (6411Mb) or more, with the most common modern sizes being 1Gb, 2Gb and 4Gb.
Most programs (eg TomTom, games etc) when being installed will give you the choice of installing to either internal memory (RAM) or the storage card. As internal RAM is so small, wherever possible programs should be told to use the storage card.
Some older programs designed for WM5 or badly written WM6 programs automatically install to RAM without giving you a choice. As in these cases you are stuck with their choice, it makes sense to install everthing you can off to the storage card, as when main RAM is full the PDA can rapidly get issues.
On many new devices, the internal camera's menu setttings offer the choice to save in RAM or the storage card as preferred. Again, the storage card is preferable.
Storage cards are flash-based, ie they do not lose their data when the power is off or the card removed, whereas traditional PC Desktop Computers taught us that RAM is volatile and everything goes when the power is cut. I think this is where the confusion where storage cards are considered "rom" by many people.
One minor issue that I have found on my HTC is that when connected to a PC via ActiveSync on Windows XP, clicking Explore to browse the device only lists the internal memory and certain fodlers only, but not the storage card. I've only tried this on a couple of devices so far.
I therefore had to use File Manager to copy any pictures I'd taken and stored on the memory card onto main RAM before I could use ActiveSync to transfer them to the PC. (I was far to lazy to open the HTC and take the memory card from uder the battery and into my USB card reader!)
Windows Vista however lists both the HTC and its memory card, allowing me to manage files directly on the storage card. It is the sold benefit of Vista over XP I've found so far. (Meoww! Saucer of milk to table five!)
Wiping:
Quick Answer... Take out your SIM card and any storage card, hard-reset the device and sell it without fear.
Paranoid Answer...
PDA: A hard-reset is considered a wipe. I personally do not know anyone who has managed to retreive any data from a hard-reset PDA. I suppose it would depend on whether the backup power to the 64Mb/128Mb RAM is interrupted when the hard-reset activates, properly wiping it. Various stories of the Police using specialists to get data back exist, but this appears to come from wiped storage cards and SIM cards, and these were on Phones, not WM PDA's.
Storage Cards: Some types of card will properly format, but data is scarce. Generally to permanently wipe a Micro/Mini/SD or whatever card, the easiest thing is to find a big file (either directly on the machine, eg, a folder with a few duff pictures in it or transfer a large file using a USB card-reader and a PC) and then use File Manager to replicate the file/folder until the storage card is full. Once all the Ones and Zeros that made up your old secret stuff have been overwritten, it will take NSA level resources to determine what there was before.
SIM cards: I have heard of devices which could read the 99 contacts and 20 or so SMS messages that could be stored on a standard SIM card. I have neither the time nor inclination to find a link to one! Best off asking "will it blend?" to dispose of old SIM cards. A blue-flame lighter works well too!!
Regards
Ivan
* Various websites like XDA-Developers.com and others provide information and utilities to enable you to make your own customised Extended ROM, so you can "pre-install" all you preferred programs as well as dump all the extra faff the networks add in, saving precious main RAM. It's a complicated and risky process, because if you get it wrong, you can trash your device.