Nostr can be private if you encrypt it, in fact you can be sure its private since its verifiable on public infrastructure, Formstr responses are already encrypted.

Cooking up an update for private access controlled forms as well.