This is at the root of Nostr, however.

An open and public network that enables things like social media where you own your data means that *each person* has to take personal responsibility to preserve privacy where they want it.

The easiest ways will be only using relays you trust/control and using a always-on VPN on all devices to hide true source IP.

Outside of that, people should assume everything in Nostr is public and act accordingly.

That is totally fine and should be a similar expectation as centralized social media, except that in this case *anyone* on your relay(s) can see all of that data, where as with Twitter etc. only Twitter and 3rd-parties they share with can.

If you make much of the data we're putting into Nostr private by default, it will be a pretty poor social tool.