Question:

Why are private alerts visible to users who are not assigned to Online?

Answer:

Out-of-the-box Org Wide Default Sharing Settings for Alerts is set to Public Read/Write. Setting this to Private does not work Online. For Offline devices, the WHERE clause on the Alert VMobile Object Configuration record needs to be modified.

Related Documentation:

CRM Help Documentation: N/A 

Thank you