Haven’t looked recently but when it came out, the story was that it was private by default. It uses a regular API token, which promises no retention.