Sending the current URL and directly from your own IP too is quite the privacy hurdle already. I’ve already posted on what kind of things could be done to improve this, but first, a notice.

Your README says in the Privacy section:

Does not track your browsing

On the current implementation, this should be changed to:

Enables unverified third parties to track your browsing data

As that honesty is quite important.

As for measures that could be taken to improve on this issue, I have three suggestions (I might Issue Tracker them to the codeberg later, if I can find my credentials XD)

• Set up a uBO-stye control pane that allows to set this on or off per-domain or per-site. Bonus points if it allows for per-site specific on which lemmy instances to use the same way as uBO’s “3p” Custom Rules does. This already prevents a number of undesirable use cases, such as automatically sending LAN / non-DNS names to third parties when they can’t really be searched for anyways.
• Anonimyzing assist: Allow for sending only the global context of the visited site (eg.: only the domain) instead of the full URL.
• Anonimyzing assist: Allow to cache requests to send them later / send them in batches, to avoid clock-based / timezone-based tracking attacks.
• Anonimyzing assist: Allow for the browser-specific request being sent through a proxy or relay, so that IP origin information is not leaked. (I think this only really makes sense for users not logged-in?)