Check out my comment here: https://lemmy.one/comment/325139

The relevant parts for you are:

• The default configuration for Lemmy does log IP addresses through nginx's access log.
• The default configuration doesn't rotate or prune the logs; they are maintained indefinitely.
• The default configuration doesn't encrypt the logs (file-level encryption) or disk (block-level encryption.)

The requests and IPs are therefore vulnerable to:

• The server admin can check the logs (who can SSH into the server itself, not just an admin on Lemmy)
• The hosting provider can check the logs (the file is not encrypted and they own the disk they're stored on)
• A government can subpoena the server admin or the hosting provider for these logs.

A Lemmy instance that is concerned about its user's privacy should either disable access logging, or log to RAM, and ideally encrypt it too.

However, this raises the issue that you don't know what software the server is actually running. The above analysis is based on looking at the default configuration of the open source code. But if they were to change the logging to be more secure, you would need to trust them when they say that's actually the code they are running.

Have you considered using a VPN like Mullvad or even Tor? Lemmy doesn't have the same issues with blocking VPNs as reddit does. (Although some fediverse instances, such as Kbin, use Cloudflare, which does its best to block VPNs/Tor.)

Let me know if you have any other questions.

Thanks for the question and for bringing it to our attention. We are (mostly) all quite new to the Lemmy platform and haven't yet put together a specific privacy policy for the instance, or looked into customizing the default behaviors regarding logging. For the time being I would suggest you take the usual precautions of using a VPN and following privacy minded practices when creating your account. We will post a sticky about it once we have had time to consider all the ins and outs.

Use the search to find a privacy community.

I am in no position to ask your question because I dont have the technical knowledge about how Lemmy works within, but I can share my perception of what happens in all internet medias: You are only going to see how truthful the platform is when the owners get a court demand or law enforcement at their doors.

Until this point you can hear a lot of sweet speech of defending freedom, protecting privacy or piracy advocacy, but when the police is involved is where things get problematic.