I can associate your npub to your IP and get your locations and movements. I can do that to Damus users right now. I won't do it out of respect, but there is such a large set of possible ways to do it that I can't imagine this being something we could realistically prevent across the board.