Privacy-first journaling: what it actually means in code

The five choices that turn “we take privacy seriously” from boilerplate into something you can verify.