When creating an album or document in a user account, only the author of the album has access rights. No one can see the data: it is not available on the Internet and is not public data. It is not possible to get the URL or anything else to get them. All albums and documents are protected by a user account.
At the same time, the user is obliged to take care of the safety of the authentication data himself: Do not give your username and password to anyone, avoid fishing sites and so on. Everything else will be protected on the Photo-Pick side.