This is not correct; the bookmarklet sends along the contents of your browser at the time you click it. Thus it can get around paywalls without having to have your login info.

I believe Marco has said on his podcast that URLs added via the API do get slurped from his servers, but I'm not 100% certain on that.