HP now has a password protect feature so you can more safely install it on a public web server or you can expose your rPi to the outside via a port redirect. Either works. Be sure to include a robots file so search engines won’t find it and be sure to disable directory listings on your web server. There are still risks involved but they are manageable - and not worse than handing your data over to a third party to protect.