@orangelamp Most of Mastodon data that can be scraped is explicitly public data, like public posts, and profiles. Private user data is not exchanged at all, and private posts go through user-controlled authorization before they are sent anywhere (approving a follower request). Beyond this there are mechanisms for hindering scraping of public data, like "secure mode" added in 3.0 as well as general rate limits, however the matter is complicated by the fact that public data has to be public.