Even if you only publish to a private relay, anyone with access to that relay could broadcast your notes to any other relay