especially if you run it yourself. If you don't have a loaded sawed off sitting near your server rack in case the machine spirit within grows too strong, you aren't servering correctly.
Your actual browsing of lemmy is moderately private, provided you trust your server.
Not exactly. Many of the big instances have Cloudflare (or similar) sitting between you and the server, providing the HTTPS layer while watching everything you read and write on Lemmy. In cryptography circles, we call this a man-in-the-middle.
Your instance (sh.itjust.works) is one such instance, by the way, as is lemmy.world.