@cal @ElfLord As far as I can tell, at least for "privacy"-enabled/private" profiles in a #Mastodon instance, a third-party can only see publications already made visible to the person at some point before the visit. @cwebber can perhaps correct me on this but I think this is also part of the #ActivityPub #W3C #standard, which #Mastodon also follows.