Start with the smallest request
A writing tool rarely needs the whole document to improve one selected sentence. Narrow inputs reduce exposure and make the interaction easier to explain.
Make the trigger explicit
Ambient collection is difficult to understand. A visible user action—select, invoke, process—creates a boundary that can be inspected and remembered.
Separate content from accounting
A service may need an account, plan, usage count, and device record without keeping the prose that produced those counters. Designing those records separately prevents convenience from becoming history.
Use accurate language
“Local,” “private,” and “zero data” mean different things. A trustworthy product states when a request leaves the device, what providers participate, and what remains after completion.
Give access an exit
Users should be able to revoke a machine, remove operating-system permission, sign out, cancel a plan, and request account deletion without contacting an invisible administrator.
Document the boundary
The privacy policy should match the product interface and backend behavior. When architecture changes, the copy and controls must change with it.