You should consider all public. Just the email (if provided) is known only by the admin of your instance. But, afaik, they have no legal requirement to keep it private.
Therefore, consider everything public, including DM, and that's it.
Nothing you do on the internet is private. You can remain anonymous on Lemmy by joining an instance that doesn't require an email, and not using your real name. That's as close to private as you're going to get.
I like lemmies approach of not trying to reinvent the wheel and just let people put their matrix usernames into their profile for secure communication.
Everything is more or less public. Subscriptions stay between your server and the server you subscribe to in theory, but you'd have to trust those servers not to leak anything.