I think it's best to operate under the assumption that anything you're sending to a third party is going to get spied on at some point.