Point it out*

If someone goes to a lot of effort, yes. I don't think there is anything inherent to Nostr that is privacy preserving though. "Remember, relays can see what your Nostr client is requesting and downloading at all times. They can track what you see and see what you like. They can sell that information to the highest bidder, they can delete your content or content that a sponsor asked them to delete (like a negative review for instance) and they can censor you in any way they see fit. Before using any random free relay out there, make sure you trust its operator and you know its terms of service and privacy policies." View article → You need to work hard towards that, selecting reputable relays plus using Tor or a VPN, religiously removing metadata from any files you post, and making sure you never post anything that might lead back to you in the real world. One failure and it's ruined. This is no different than other social media, or the Internet in general really. It is also easy to mass collect notes. I run a WoT relay. It collects notes from ~60000 npubs on a 2 core VPS with 2GB RAM, and it's barely working to do that. I assume govt agencies are already doing the same, except with infinitely more hardware power, capturing every note that is posted. Using AI to correlate and scan, figuring out who is who. I would never recommend Nostr to someone on the basis of it being more private, as I feel I would be doing them a disservice. It has many ticks in the plus column, but I didn't think being inherently designed for privacy is one of them.

I've already retorted to Vitor's post but the stupid shit poster I am it's buried deep down, somewhere I can't find. A simple VPN can go a long way. Yes relays can track your metadata and can correlate it with your npub, but your npub doesn't need to have any information about you in the first place. For example I challenge any relay operator to find out who created any of the forms in the

Formstr

A decentralized forms application which lets you custody your own data made possible through the power of the nostr protocol.

global section. It is not possible. Claiming nostr isn't private is stupid. You are responsible for any data you give out, which is what privacy is about.