I'm guessing that's part of how it works. Perhaps we can't consider DMs private? Perhaps the contents are though, did you try to read a DM?


The rest, yeah, those are public events, so yes, if they have your public npub, they can view all the events as if they were you, but they can't sign anything, and shouldn't be able to read anything that's encrypted.

Its perhaps not great... But what's public is public is public, including metadate. This is a good way to know exactly what that is so you can make informed choices.