Exactly. It's up to the user, Nostr, without extra steps taken, isn't inherently private. I guess we'll just have to agree to disagree.
I've already retorted to Vitor's post but the stupid shit poster I am it's buried deep down, somewhere I can't find.
A simple VPN can go a long way. Yes relays can track your metadata and can correlate it with your npub, but your npub doesn't need to have any information about you in the first place.
For example I challenge any relay operator to find out who created any of the forms in the https://formstr.app global section. It is not possible. Claiming nostr isn't private is stupid. You are responsible for any data you give out, which is what privacy is about.
Discussion
Nostr is literally the manifestation of a trustable privacy preserving tool, nothing like this exists for personal privacy, it is privacy without needing to trust, verifiable privacy,
Can you still be stupid on it, ofcourse. But no other tool allows you to be this private, while communicating publicly.
Saying nostr is not private is literally harmful to people who need privacy and now think that they have no other option than to trust a service that will eventually rug them.
The only alternate is TOR, but it's not clearnet, meaning it's not really "public". Also you can just as easily use nostr with TOR which only amplifies it's privacy benefits.