Yes that's correct, ngrok hosts servers around the world that serve as 'relays' which accept connections on your behalf and then copy the bytes through to a persistent connection initiated by the ngrok client. It's the same principle as a reverse SSH tunnel