Is there a limit to one-time cards

There should be something about that in the Revolut EULA or something like that. But I've never encountered it. The moment the payment goes through, a new card appears in the app

Can you elaborate But how private your data really is, that might be hard to answer

It's a business. A closed source. They are of course bound by laws and regulations but there's practically no way to make sure they aren't selling transaction data/statistics under the table. Also, the cards issued by them are either visa or mastercard (IDR), so these companies have that info too. And I'd bet they sell transactions analytics
Then there's also the matter of telemetry. Apart from telemetry gathered by the app for Revolut, I guess there's no way to use it without Gapps

FWIW I did not notice an influx of spam after registering an account. But that doesn't prove anything, of course

We can't inspect the code of the app. So it's probably only as private as other bank apps