> anyone can see what URLs you are visiting

this is not correct with HTTPS (query params are not part of the plain text)