It depends on the client you're using and the method you're using to communicate. Confusing... I know. If you're using Snort, Amethyst, Nostrudel, Coracle to 0xChat then your DMs and their metadata are private. If you're using Primal, Damus and others, then the DMs are private but the metadata is leaked. There's a new standard being worked on now by @JeffG and the hope is that everyone upgrades to it when he's done.