In default, Cloudinary allows generating random image IDs (URLs) for uploaded photos or setting your own image ID. Since the URL is impossible to guess, it will only be available publicly if the owner of the image can access his image's URL and share it with others. This is a common practice (it's the same way Facebook hosts your images) and is available to all plans.
In addition, Cloudinary supports more advanced methods of handling image access control: private images, strict transformations and authenticated URLs.
This blog post describes the private images methods.