Yep, everything is public. Private lists exist, and it's possible I'll add support at some point but it's not at the top of the list (heh). Integrating private lists into feeds would be a challenge, but maybe doable - although the private status would have to extend to the feed as well.
