Move less data. Expose fewer secrets. Make boundaries explicit.

Privacy is easier to reason about when the system avoids collecting or transmitting data it does not need.

Local-first is a privacy primitive

When a workflow can be performed locally, keeping user-owned state local reduces the number of services, accounts, retention policies and breach surfaces involved. Network-dependent features should identify their provider/data boundary explicitly.

Public configuration is public

Anything shipped in a static website, mobile bundle or public source tree should be treated as inspectable. Public identifiers, routes and policy metadata may be committed; private signing keys, service credentials and authority secrets must not be packaged.

Minimize diagnostics

Useful diagnostics should prefer bounded technical state over raw private content. Secrets, credentials, private prompts/source and user-owned evidence should not be included merely because they make debugging easier.

Provider boundaries

When software invokes an external AI, store, directory or other provider, provider behavior remains an independent trust/privacy boundary. A local-first architecture should not imply that third-party network features are local.

User control

Export, deletion and recovery paths should be explicit. Deleting local application data cannot truthfully be described as deleting records held independently by a store/provider.