I’d be very careful with what I use direct messaging for on Mastodon.
The way it works here is that you can send a toot/post that only the people mentioned in the toot can see.
But then if you are talking about someone on the platform and you happen to mention their username in that toot, well then they can see it too. 😬
General privacy rule: don’t write stuff here you really don’t want others to see. Something like Signal would better for that.