As rule of thumb, never store private keys in plain text and always aim to have them decodes at the client side.

Assume everything will be leaked. There is always a balance between usability and privacy.

The only thing private on NOSTR tends to be private messages and the private key.