Collect only data that improves the feature. Explain when content leaves the device, remove unnecessary identifiers, and keep sensitive payloads out of analytics and debug logs.
Give users deletion and control over persistent memory. Review provider retention, access boundaries, and support tooling. Privacy promises must match the entire data path—not only the model request shown in architecture diagrams.