Privacy Rules not working?

I have set a very simple rule for a table which contains an photo and document as part of the record. Despite setting the rule and marking the photo and document as private, it still seems I can open them by pasting the URL in another browser where I have not signed into bubble nor using the app UI. What am I missing?
image