Seems people have to relearn this lesson every few years:
If you don’t want something to be public, don’t put it on the internet. “Privacy” controls from these companies fail regularly, sometimes by design. If you put something on the internet, it will be public eventually.