No, the changes don't have to stay in the open, they only have to get given to your downstream users, not publicly in the open and not back to the upstream project. You can definitely fork a GPL project without making anything public, although your users can choose to make the modified code that you send to them public, but they might not ask for it or might not publish it if they do get it.