Nostr is a decentralized protocol that is not private by default. Kyc or no-KYC has nothing to do with the Nostr protocol. Nostr doesn't come with a VPN, just like the internet. "Relays know your IP address, your name, your location (guessed from IP), your pub key, all your contacts, and other relays, and can read every action you do (post, like, boost, quote, report, etc) except for Private Zaps and Private DMs. While the content of direct messages (DMs) is only visible to you and your DM counterparty, everyone can see when you and your counterparty DM each other." -Amethyst on Github There are malicious nodes. Lightning is not private by default, especially if you're running your own node and receiving, sending is more private. By contrast, Monero is private by default. Nsec can be compromised just like any other password, etc.

It is somewhat privacy preserving if "privacy" we don't mean "secrecy" (which is often the meaning in common usage), but, rather "control" and "ownership" (which is also the sense in which one should understand "privacy" in the context of the GDPR, for example). But, still, all relays will know your IP address (unless you're using some kind of protection outside of the Nostr protocol) and all your activities are public. Calling Nostr "privacy preserving" and "private property protocol" is rather misleading.