Console output from both client and server is always sent to the browser, although a user of a published app would have to open the JavaScript console to see it. An exception to this is HTTP endpoints, where print output is only recorded in the App Logs and not sent anywhere.
If you wish to log sensitive data, I’d recommend doing so using a Data Table with no client-side access.