In our application, there is a kind of a "share" feature that sends an email to a user-provided address. This email contains a link with a secret access token (as part of the URL) that is valid for a few days. The page where this that link points to contains confidential information.
Now there is a feature request to use Gravatar in the whole application to show a nice picture of the user, if the user happens to have a Gravatar account. Now I fear that by including Gravatar on the confidential page mentioned above will compromise that link.
Is Gravatar (or rather Automattic) able to see the referrer where a request to the user picture is coming from? If yes, is there a way to use Gravatar in a way that private URLs as mentioned above aren't exposed?