Collect less
The safest unnecessary data is the data never collected. Our starting point is to minimise what leaves a customer’s device and to explain plainly when information must be processed elsewhere.
That principle becomes especially important for financial and administrative software. Convenience should not quietly expand into indefinite collection.
Make boundaries visible
People should be able to understand what is local, what is transmitted, what is retained, and what can be deleted. Those boundaries belong in the product itself, not only in a policy document few people will read.
The implementation will vary from product to product, but the standard will remain the same: deliberate access, responsible defaults, and no surprises.