Your DMs are not private on most Fediverse platforms. The ActivityPub protocol doesn’t provide encryption or filtering on non-local content, and treats DMs very much like it treats comments or posts.

For instance, I equipped a Wordpress install with the ActivityPub plugin and connected it to a small Mastodon instance. I found that it could read every non-local DM coming from that instance.

Essentially, if you’re DMing within an instance, it might be somewhat secure, depending on how the instance is setup. If you’re DMing between instances, there is no security - assume anyone who can read the ActivityPub feed can read your messages.