So you have raw database access and you can see that data. Why is this surprising? The systems I’ve used that solve storing data encrypted have massive usibility hits around exchanging and authenticating services to a point where it sucks. I’m not saying this couldn’t be fixed but should it? Most services that uses a database will be inline with your discovery of how Lemmy uses that database. Storing something encrypted that is meant to be viewed publicly is the same outcome with more steps. If someone cares enough to monetize it just patch the code to change whatever behavior you don’t like. I havent seeing anything about an acceptance test for Lemmy instances or anything that requires someone to use an unaltered version of Lemmy. How do you know the server admin isn’t already doing all of this? You don’t. Don’t expect privacy in public spaces.