In bold text in the manual (Protecting Data - Bubble Manual) it says:
If you haven’t explicitly created privacy rules for a given thing, then the data is not secure.
So you need privacy rules (unless all your signups are public information!).
Privacy rules I found the trickiest part of Bubble, and it took a lot of experimentation to find a roles and permissions design that made implementing privacy rules possible.
But as a first step, the simplest thing to do, add on every Thing, a privacy rule so there is no public access, (eg ‘when user is logged in’ (assuming you don’t have users) and turn off everything in “Everyone else (default permissions)” and see if your app still works. If it does great, if it doesn’t then watch the video by airdev about privacy rules.