Correct. The link file is the SHA256 hash + extension, just like nostr.build. There's no public "list" function, so unless someone already knows the hash, it's private unless you share the link.

Nice, just signed up!