Since it is coming up again:

Mastodon isn't private.

Expect anything you toot to be visible to everyone, regardless of your settings for visibility.

Mastodon is built on a system that isn't appropriate for private conversation and the work arounds for private toots and the like are not in any way robust against someone just ignoring them.

@inmysocks why can't we rely on private toot. If we trust the instance admin of both user its okay, no ?
@marsxyz it can go to other non-mastodon instances, and it is possible for it to go to unknown instances. The OStatus stuff doesn't support restricting where a post goes.
@inmysocks oh. I didn't knew... Too bad. No workaround ?
@marsxyz the workaround is to use an appropriate tool for private conversations instead of mastodon.