Who can see it
The preview URL carries an access token (?auth=<token>). Without the full URL, it shows a login wall, and it is never indexed by search engines.
Anyone you send the full link to can open it, which is how you show work in progress. See Project Visibility for the full picture, and for how to lock down a published app.
