I'm going to guess they do have some access. I built an inboxsdk app, and we do indeed have access, to at least what is rendered on the page. But anything that is running js on that machine has that same access. This might be deeper than that if they connect to the API on your behalf.