Indeed, for better or worse nothing here is private. My instance database has all user activity stored even from other instances, such is the nature of ActivityPub.