On the server, you can create a publication like this. this.userId is the id of the user who is currently logged in. If no user is logged in, you might want to throw an error and respond to it.
import Secrets from '/imports/collections/Secrets';
Meteor.publish('protected_data', function () {
...