I can't imagine that any app that currently exists gives a shit about exploiting your data. Lemmy is too young for that to really be a problem.
The real problem is that nothing on lemmy is private because of it's federated design. There have been some discussions the last few weeks talking about this, but just about every interaction you do is broadcasted out to every instance, and its social media so of course anyone can see what you post. Things like viewed posts and saved content should stay on your instances server, but assume every other action is public.