What does an unqualified Cache-Control: no-cache in a response actually require?
The response must be treated as having max-age=0 but may still be served stale
The response must not be stored by any cache
The response may be stored, but must not be used to satisfy another request without being successfully validated first✓Bonne réponse
The response may be stored and reused, but must not be stored by shared caches
Explication
no-cache permits storage and forbids reuse without revalidation; the directive that forbids storage is no-store. Prohibiting storage by shared caches specifically is what private does.