it doesn't seem able to list any toots from me, but did autocomplete my username with avatar, so they have a scraped user database for sure. also no known way to even opt-out, not that that'd be enough. shit like this needs actual consent through opt-in