Normally, all images created in Thinglink are public. You can however make the image "unlisted", which just simply means that the image does not show up in other peoples's streams, interesting images, searches, etc. It can only be seen if you know the URL of the image.
Now, when you need to keep something secret, you should consider a private image. You can set an image private by going to the "Settings..." window in the editor and choosing "Private" in the dropdown menu.
When the image is set to private, below the selector you can see a "passkey". If you have a need to share this image with someone, you can give them the passkey and direct them to the URL of the image.
If you reset the passkey, any previous passkeys will be invalidated immediately, and the image can no longer be accessed.
For some old images, the passkey can be empty - just click on "Reset passkey" to have a new one generated.