Those events are ephemeral and encrypted, so they don't generally sit anywhere for too long, and not particularly useful for anyone except the app and the signer. What's your concern here?
That anyone listing to relays your nip46 events are on, are possibly hoovering up your client-side activity.
That is indeed something that will eventually bite us. Do you have any ideas about how that could be fixed with nip46, without switching to a new protocol? Maybe nip46 relay could require nip42 auth and only serve you the events that match your identity?
Oddbean new post about login | logout