But that's mint data, not user data, no?

It's both. The metadata itself can be linked between spenders and redeemers. Hopefully there will be mints that use proxy schemes to mitigate this