It depends on how you integrate it, but yes, you're largely right. If they have your JavaScript they may have your cards.