1.) You can designate the photos as Public (anyone can browse them), Private (per-account access; login required), or Unlisted (anyone can access, but must know the exact URL).
3.) Google, and others, have had breaches in the past. Thus, you can feel relatively confident in uploading photos of your last vacation, but a good rule of thumb is to omit anything that would cause you or others great distress if they were suddenly made public.