Third parties are not supposed to be able to get your real name, if you do not use it - plus, Steemit does not show your email addy (apart from when you post it in your header).

Most of what you do here does not involve more than you using your posting key - the active key is only used for money transfers etc.

Why then does Discord need you to use your active key? (through Steem Connect...but still, how difficult is it to capture, if you know it is about to be used?

Of course, whatever firewalls you use and whatever other systems, if they are determined, security /agencies orgs can get your data...but the more you use to make real details hidden, the more expensive it becomes to crack, so they will only do so if they know or strongly suspect you are involved in things dangerous to the country.