I have been under the operating assumption since circa 2006 that anything done in a browser is potentially sent of somewhere to somebody's server. If I want privacy, I use tor.
Anything that's not the body of an https request is at minimum going to be logged somewhere.
What frustrates me is that everyone goes out of their way to make fragile, internet connected and internet dependent applications when there basically no need to.
There was pandemonium back when Ubuntu first started doing that in its search line, for example.
Now, no one cares and thinks it's "just how it is", except for some privacy holdouts, like myself.
This isn't the way the world used to be.
They shouldn't be. Logs containing URLs are commonly considered private information, and while it's a bad practice to put passwords, etc. in the URLs, people still do it, and even more often things like tokens, keys, object IDs etc. are part of the URLs. Disclosing this to a third party is essentially a MITM attack, and even though we're talking only about user input, this still includes stuff like URLs copies from emails, terminals, documentation files, etc. - and those may contain very un-public thing. Simplest example - do you consider the password reset URL many sites send to be public or private? Of course, not many people would type it - but people would copy-paste it and then maybe type something else - and who can guarantee the whole URL isn't then sent to an untrusted party?