A public subnet has a route to an Internet Gateway, so instances can be reached from the internet (with correct firewall rules). A private subnet has no direct inbound internet route; it’s commonly used for app servers and databases. Often the load balancer is public, while app/DB stay private.