If it is software how do you know who has implemented it and whether the instance respects privacy?

I discovered google had recorded all the hashtags I had visited on mastodon. I thought I had turned off this recording, but there were additional categories which I think they have added since the last time I was there.

Of course the UK government and ISP record everything too, by URL, so that includes hashtags, even this post has a unique URL.