This covers query strings, but in theory, if you've got any third party JS on your registration/private page, that JS can get the contents of the form and exfil

This covers query strings, but in theory, if you've got any third party JS on your registration/private page, that JS can get the contents of the form and exfiltrate it. So, basically any 3rd party analytics has the ability to do this, query string or no?