My interpretation is that the overlord purchases are public information. The only thing that the overlord keeps private from the heroes are which cards he has culled from his deck for any particular quest.
Is that meant to be kept private? I think I've always shown what card I take out.
Definitely. It is written explicitly in the rule book.
Descent 2nd Edition Rulebook, Page 20, Spending Experience Points: Overlord wrote:
Before each quest (but not each encounter), the overlord player may choose to temporarily remove a number of cards from his deck in order to optimize his strategy for the quest. This is done in secret so the hero players do not know which cards the overlord player has removed. He must keep a deck of at least 15 Overlord cards for each quest. Any removed cards are set aside for the duration of the quest. After the quest ends, return any removed cards to his deck of Overlord cards.