That's certainly a legitimate concern, but keep in mind that it's hosted on and sponsored by Github, who already have access to your private repos.