The instance is hosted by an Estonian company with servers in Canada. The host does not use google analytics and strives to eliminate as much tracking as possible from their systems. The communications and files you upload here could, theoretically, be viewed by the third party host but that is true of anything online and incredibly unlikely.
If a user reports a post to the administrator for moderation the admin (Mike) will be able to see it even if it is a direct message. Otherwise, he does not have access to any personal communication on the site.
This is, however, an ActivityPub federated server. This means that other people on other federated servers can find you, send you messages, etc. This also means that any information you put in posts, whether they are public or private, might end up "federated" -- basically, a copy of your post gets put on any server that reads your post.
If you want decent privacy (the info doesn't leave our server), the only way to do that is to set your account to private, only accept friend requests from other Friend Town users, and only ever @ mention other Friend Town users. Once you start talking to people on other servers, all bets are off. Any private message you send to someone on another server could be looked at by the admin of a different server. This is kind of like email: if you are on a private email server, and you send an unencrypted email to a gmail account, congrats, Google now has the content of that email. But also, you do this every day, so, hey. The internet!
I hope this document has made it clear that Friend Town wishes to collect, retain and process as little information as possible in order to provide service.
A small private social network for a few friends that is free of advertising, algorithms, surveillance, and all the other things that make big centralized corporate social networks suck.