I know, I wasn't trying to say that Nostr is bad because of this, but saying "we own our data" here doesn't seem right.

For this, all data would have to be encrypted and we would have system where we can set who is able to decrypt the data and for how long. Would be a very different network (and maybe could even be built on top of Nostr).