Raze is correct.
That said, it would be really nice if the second player had the option to make (but not load during the host's session) his own save file from within the actual game. Obviously the second player has all the data on his client already; s/he just lacks the option of saving it to a saved game file.
Now, I can respect that the host might not want to allow random players joining his or her game to have that option, but I feel that if you're going to allow random people to join your game in the first place, you should have minimal expectations of privacy to begin with.