Old post but I thought I would comment anyway.

I always without exception use a VPN, if not VPN+TOR on nostr. Nostr by design is on the internet forever and who knows who is running relays. Not a great situation if you ask me. In no way shape or form are DMs on nostr private and any meta-data there isn't private either.