Transferring values securely from page to page

If I define an App Variable (let’s call it ‘superSecretValue’) and set it in one page, and then load another page that then uses that App Variable. Exactly how is the App Variable transferred from page to page? I know you can set an App Variable using a URL parameter, but would someone be able to “listen in” on the http requests and responses, and then get their hands on my App Variable value?

I am assuming not, since apps run via HTTPS, but I want to be sure. Anyone?