I'm pretty sure that anyone can access your public library, given your private (public, but only known to you) URL ; this URL contains a number that is unique to you, and is composed in a way that you decide. There is no way to obtain a listing of the files in your library, if the exact address (URL) of the catalog file is not known.
So, all in all, yes your library will be public ; but no, nobody will be able to access it, if you don't give away the address of your stanza.xml catalog.
Changing subject almost abruptly, I released
a new version of my
calibredbxtract tool, which adds support for generating authors, series and recent additions catalogs.