Yes, unfortunately that is the case.  It happens far too often on nostr, for example fiatjaf's njump dot me and benarc's nostr dot com contain spyware that deliberately send your ip address and browsing history to certain VC (bad guys imho), without gaining user consent.  I try to raise awareness of this, but there is very little action, sadly.  Nostr needs to develop good reputations for those that respect privacy.  Most currently do not.  Sadly. 

 Wow I didn't even know that. Really bad.

But in general, the Nostr protocol is just not private, but pseudonymous - and thus succeptible to the same dragnet-style surveillance as Bitcoin. You just need to collect enough metadata.. 

 What spyware are you referring to?