The answer is always yes for hosted services. The data has to be stored somewhere, and it is readable if not explicitly encrypted on your device before being send to the server. Some things like passwords are usually handled differently though, they are not readable by anyone.

That’s one of the reasons why picking an instance is a big deal. You trust that instance with moderation and handling of your data. If you’re not comfortable with any instance then you should look into hosting your own!