Does it mean the real url will never be exposed even after payment?