Virtually everything you do on Nostr is public. Want to have scary fun? Login to a nostr client using someone else's npub. Yes, their npub.

You often can, yes. That's how the data gets included in the algo.