Yeah tried this myself and only got metadata. Guessing that's all OP's friend saw too unless OP sent the nsec by accident.