Privacy as architecture, not policy.
Cloudy can't see anything until you turn the mode on. Every signal — photos, places, workouts, calendar, music — is off by default. When he writes about a photo, the photo never leaves your device. He gets a few words about what's in it, not the image. I chose iOS first because Apple's privacy model lines up with how I want this to work.
