Not if your API design is so bad that any third party can access them, apparently. Aside from that, I'm pretty sure they'll also get stored on their servers, i

Not if your API design is so bad that any third party can access them, apparently. Aside from that, I'm pretty sure they'll also get stored on their servers, if you have not declined all the nagging iCloud sync requests.