[millstone]

Apple has sketched out their middle ground here: differential privacy. They're already using this for e.g. QuickType suggestions. However I still agree there is a significant risk here.