Since it is coming up again:

Mastodon isn't private.

Expect anything you toot to be visible to everyone, regardless of your settings for visibility.

Mastodon is built on a system that isn't appropriate for private conversation and the work arounds for private toots and the like are not in any way robust against someone just ignoring them.

@inmysocks That's not exclusive to mastodon, this can happen with any social network. If you want private and encrypted communication there are a lot of alternatives (e.g. Signal).

@JORGETECH yes, that is kinda the point of what I said.

Although the dependence on phones makes me dislike signal.

@inmysocks Signal was just an example I gave, I bet there are many others that are not phone dependent.
@JORGETECH yes, I mentioned two of them in my original toot.

@inmysocks perhaps a lot of folk here are way too young to remember CB radio being a popular hobby - there are are some parallels with this subculture (although today you have more features).

Anyone could join in and communicate on whatever frequencies were legal in their country (or take a chance with eluding the authorities) - but none of it was private, anyone else with a radio scanner and recording equipment could monitor the transmissions.

@inmysocks why can't we rely on private toot. If we trust the instance admin of both user its okay, no ?
@marsxyz it can go to other non-mastodon instances, and it is possible for it to go to unknown instances. The OStatus stuff doesn't support restricting where a post goes.
@inmysocks oh. I didn't knew... Too bad. No workaround ?
@marsxyz the workaround is to use an appropriate tool for private conversations instead of mastodon.