To expand on 8128's answer, which is mostly right, the automated retracer does not set the bug public. It merely adds a stack trace to the bug so that it is more clear where the problem lies.
The sensitive information is kept in the bug report, as it can be invaluable to a developer working on a fix. The bug is reviwed by members of the ubuntu-bugcontrol team who will evaluate the bug and either keep the bug private, and assign specific developers, or remove the sensitive information if it is not helpful to solving the issue, and then mark it as public.