LeftLevel keeps this topic practical: define the trust boundary, make the behavior visible, and avoid promises the project has not earned yet.
The protocol and app should work together so reviewers can test what the website says.
LeftLevel notes
Metadata minimization without mystery
Reduce what the system sees without pretending to erase every risk.