It is probably best to think nothing on Lemmy is private. Any instance with at least one user subscribed to a community will receive updates (messages and votes) on the community. Instance admin can go into the database to see any private message between any user on that instance.