in addition to what others have said, also have your browser fingerprint as fairly generic, and what is unique should ideally be randomised upon each start of your browser. There's nothing stopping a Lemmy instance from running clientside code that gathers your browser fingerprint, and if they are well-resourced enough to have access to fingerprint data from other sites, they could correlate it to de-anonymise you.