I guess that depends on what the vending machine is vending. Maybe if it's a request to do with something that's already public on Nostr then info about that already-public something, as long as no info about the npub themselves.