I disagree, assuming there are no other security holes (browser extensions, whatnot) then the server will initially receive it, but they can then forward that data to any third party they wish.