Honestly it all depends on how paranoid you want to be. Say for example you had a rough breakup and want to get away from your significant other. For that person, maybe mentioning a city is enough to know where you will likely be? (Assuming they know it’s you using the nickname and location of family relatives, for example).

For a server host, like a Lemmy instance, if you don’t use a VPN, they could already have a general idea of where you live (if they wanted), even without you telling them. That’s because they can see the IP from all connections (if they wanted).

For a random person like me, on the other side of the world, I’d probably need a bit more than just the city.

I’ll leave what is a significant risk up to you. Just know that it depends on a case by case basis, who you’re hiding the information from, and how intent your opponents are in wanting to obtain that information. So, if there is little reward for the trouble, they probably won’t even try.

All of these things are generally called opsec (operational security), if you’re interested in researching more.