This is mundane, but worth noting.
For years we kept some shared family material private by not sharing the URL. It worked, the site was never indexed -- until recently.
I'd shared one of the album URLs on Facebook. That did it. Even though my page contents are shared only with friends, I suspect Facebook indexes any URLs it comes across. Probably most of my friend's Pages are not themselves public, so their view of my post was probably shared.
It's not a surprise that the URL leaked, but it's noteworthy that it remained private through tend years of Google. It only broke when I started using Facebook.
I renamed the URL, so it's secret again. I won't publish the new URL to Facebook, I'll return to sharing by email.
So what about Picasa Web Albums? They are also commonly shared by exchanging a "secret" URL, and I've shared some on Facebook. Interestingly these aren't indexed in Google, perhaps because Google doesn't index non-shared albums.