Every time this happens the debate goes the same way — trust Google or don't, switch to Proton, self-host everything. But the real issue I believe isn't whether we trust Google. It's that the data existed somewhere it could be taken from in the first place.

I've been thinking about this a lot while working on a side project. I ended up making it work entirely offline — no server, no account, no network calls. Not out of paranoia, just because I couldn't come up with a good reason to ask users to trust me with their data. Turns out the best privacy policy is just not having anyone's data.