When you look at the address of your app it is a subdomain of the main top level domain bubbleapps.io
If you perform a reverse DNS lookup on this domain, it only shows 1 application running here, and no idea why that one even shows up! So apart from the 1 domain, it is correctly blocking dns zone transfers.
However, it wouldn’t take much to setup and perform a webscrape and iterate each possible sub-domain to find out what is there. I just tried putting in a few random domains, and found something on each one at the /version-test/. Try it, a, b, demo, test, bubble
So, can someone find your app, yes. If you are concerned, use the application level username and password setting in the settings tab, this will stop prying eyes.