THE POST'S PRIVACY
When you post a message (toot) you can choose between 4 types of posting:
PUBLIC - Your post is public, appears on public timelines and everybody can see it
NOT LISTED - Your post is still public but doesn't appear on timelines. People can read it only if they are cited in it or if they go to your profile and scroll your posts
FOLLOWERS ONLY - Your post is still half-public because only your followers will see it. At their eyes it appears as a regular public post
DIRECT - Your post is private and viewable only by the people cited inside the post.
Anyway remember that Mastodon is designed to spread discussions and not for privacy: your Instance admins are capable to read all your messages, included the direct ones.
For encrypted messaging there are other platforms like https://matrix.org