The information given by Facebook on this
point is very clear: only you and the person you send your private messages to
can read them. Certainly there is no reason to think that the company itself
would read your messages or hand them over.

However, they don't encrypt messages or allow users to do so, so it may be
possible for someone else to get hold of your messages although there doesn't
seem to be any evidence that this is happening so far. Also, they do
change their privacy policies a lot, and there are real worries about
their use of personal data for marketing purposes, so I wonder if they could
state 100% that they will never let private messages be seen?

Just now the UK government is seeking more powers to monitor social network
use. At present this doesn't extend to private messages, or not without a
warrant, but it's a worrying development.