privacy

The on-device privacy argument, stated honestly

Running the model locally is not a privacy guarantee — it is a precondition for one. Only a mechanism that refuses by default makes the boundary real.