Not sure "you own your own data" is the right way to put it (I don't word it like that), but here is what I think they mean.

If you use a mainstream platform, the platform owner can, at least at the *technical* level (they might have all sorts of legal, economical and practical reasons not to):
- Delete your profile.
- Delete some (but not all) of what you publish.
- Publish things with your identity.

When you use Nostr, you know full well what data is signed with your key (or, at least, you *can* know), you can very easily have a backup of everything and everything is verified, so none can publish in your name.

That said:
> It's not even really clear where the authority to do any of this comes from. There's no user agreement or anything. If I do own the data, it's certainly not treated that way.

Note that TOS are only as strong as the law makes them strong (usually contract law, but INAL and this is not legal advice).
Laws exist that can overrule things the TOS say. Also, laws can say things TOS don't say and those things will apply regardless of whether there's any TOS anywhere.

In the EU and the UK, for example, the GDPR will apply regardless of what any TOS anywhere says. So, at least in principle, you will absolutely have the authority to object to certain usages of any data associated with your identity, especially for targeted ads.

Whether companies will follow the law or not, is of course a different question.
But the answer to where authority comes from is always the same: from the law. And indeed only the law can give value to any TOS anyway.