Correct. But that doesn't mean it's private at all. An attacker still sees everything in and out via zaps, which is how most people use it. Our defaults have never ever been private.