Your instance could (edit: theoretically, if they’re running custom Lemmy code) track you by your browser fingerprint (screen size, installed fonts, plugins, etc.). Others could keep a profile on you based on what you comment/post/upvote and when.
So if I’m on an app instead of a browser, that app developer would have to provide info on me too?
As for what I comment/post/upvote, that’s not really what I’m asking about as that’s a profile on what I do, not who I am from an identifiable point of view (correct me if I’m wrong)
Depending on the content you post though, it could hypothetically be traced to you. Potentially even mundane things like mentions of geographic locations, word choices, common phrases you use, common topics – all of those could be considered at least partly identifying in the right contexts (assuming someone was looking for it and already had info about some particular cue that indicates you).
The point is: you can’t really be too careful, and realistically should assume there is always a way someone (including yourself) could be jeopardizing your privacy, if not overtly (by some kind of software or network tracking) then by holes in operational security.
