Addresses are masked by default. Reveals are recorded against your user with a purpose, and the CSV export contains masked values unless an Owner or Administrator explicitly requests otherwise.