@Jules that is my impression, yea.

to be fair i'm not sure mastodon has promoted itself as a privacy heaven; if anything it seems less private than a locked-down twitter account due to your toots being stored on all federated servers. admins could conceivably peek at them in their database even though they were not themselves in the intended privacy group.