As far as I am aware, privacy is as much a part of Nostr as you make it.

Whoever knows your npub can see everything you post. If what you post can be used to identify you, it will be.

For example I shared a picture of my actual car which can be used to identify the country my car is registered in and the insurance company it is insured under. With a little bit of social engineering that alone can be enough to doxx me.

My chosen strategy is to not be important enough mark for anybody to target me specifically while making random attempts reasonably difficult.