According to the current readme: https://github.com/LemmyNet/lemmy#features you will be able to delete all your post with account deletion. This also align with the warning text before deleting your account.

Also most instance are hosted by community members, and are community funded. I think most instance don’t have the interest, or even the means to sell your data.

However, by the nature of OSS, everyone can modify the code when they start a instance. So theoretically, the admins can track you. Also by nature of the federation, your data will also be present on other instances that is federated with yours, but what they got should mostly be public informations (namely information of your post). And they don’t necessarily need to delete that info after you deleted your account.

That being said, the privacy aspect of these small community-funded federated service should be order of magnitude better than most other social media site, where their entire business is to spy on you and sell your data.