Actually the query string params are encrypted with SSL. However they may very well show up in web server logs