I see they have a private mode, how does this work exactly? How does it make sure it's archiving the home page of my bank's website and not my personal dashboard?
I'm sure that's exactly what it does. It is definitely not archiving some Facebook pages I've been browsing (that I would actually like to archive). It's only been capturing the login screen or an error about abusing the site.
Other than that I imagine it leaks things like /bank/account/id/75795 but the crawler will drop it when it returns a 40X.