This is somewhat my concern. I have surface scratched knowledge or at least i have heard how a photograph can contain metadata that has info of whereabout the file was taken etc. So i was wondering if the same is applied to when creating a new file for digital painting.
There's known and well documented metadata fields in many files. For example common photo file types contain the used camera and lens type and shooting settings. It's no problem to remove that known and well documented metadata, numerous tools are available.
Then files can contain not so well documented data. Programs can insert for ex. your user license number, your IP address and anything else they can find in your computer. Some of that data can be useful to track software piracy and to prevent the software version compatibilty clashes. The rest of it can be just for future needs - to give possibilities to know something essential if that need some day occurs. And finally some of it is inserted just to find current details of you and your activities.
Programs can record where they are run and what they find all the time and send it out via the internet if you have not blocked the way. To keep the door open many programs stop working if you do not allow internet connections often enough.
And remember: Your programs run in a computer which has operating system. It and other running software can insert stuff to your files or extract available data and send it out to a safe places to be used afterwards if needed. That can be very minimal looking and difficult to find, only some meaningless looking code numbers which make possible to glue pieces together if needed and build a decent image of your interests, contacts and activities. Those code numbers need not to be detectable as separate entities, they can be slight unnoticeable noise in an image.
Every country has a police who is forced to build some capability to analyze all available data to solve crimes. The data content need not to be cracked to extract info. The contacts and and timing alone are useful.
Then there's the secret police. They also analyze data. Their job is to prevent activities which can grow to crimes or can threat the power. To earn their bread they of course must now and then also invent crimes if the employer has already named the guilty.
You may stay silent, but anything you already have said, typed or drawn or can be suspected you have thought can be used as an evidence against you.