My intention was that public should not be indexable/searchable. I fixed this.

However, if you really want private stuff, use a domain. Someone could still guess the URL of stuff on the public domain.