Word of the Tub Gods: like Twitter, Mastodon sets your posting default to Public. If you only want your toots visible to other people on the instance, go to Preferences > Other, and under Posting Defaults set Posting Privacy to "Unlisted".
Follow
Well, not exactly. Turns out they're unlisted in public timelines, but still available by URL. See https://docs.joinmastodon.org/user/posting/#privacy
