1.) You can designate the photos as Public (anyone can browse them), Private (per-account access; login required), or Unlisted (anyone can access, but must know the exact URL).

2.) Google has a detailed privacy policy. It satisfies most people, but still leaves a lot to be desired in my opinion.

3.) Google, and others, have had breaches in the past. Thus, you can feel relatively confident in uploading photos of your last vacation, but a good rule of thumb is to omit anything that would cause you or others great distress if they were suddenly made public.