Thank you for checking :)
I did saw that but was confused too about what the definition of "privacy" was.
I finished testing going back and forth with two accounts and the state of the art for NostrChat is:
  • Messages do are encrypted for I need the nsec key to decrypt a message sent to me.
  • Groups are public as you described: anyone with the link can get in, and there's no admin capabilities other than being able to change the group title, description, icon, or to delete it. So groups can be easily invaded and not only you can not expel a user, but you can not even mute him. You can only hide one comment at a time. So the only thing you can do with a ruined group is to delete it. This is a fundamental deal-breaker sadly.
A group chat client I saw that has a lot of potential is "0xChat", but it's not available for Android 9 :'(