[avivo]

I can't tell from the description if the indexing is local or in the cloud. If cloud, then it's perhaps pretty similar to what Greplin/Cue was. (and involves giving another company all your data for their cloud...though it also means it's possible to later use on mobile)

[simi_]

How large can the indexing data be? I really doubt it's larger than a couple of MB.

Zero Knowledge is a perfect fit for this scenario (due to the concerns you outlined), store the data encrypted on the server and decrypt it with some personal key (most likely the password - not great security but Better Than Nothing™). The trick is how to patch the data without decrypting it each time (or exposing the keys) - although for such small datasets even that wouldn't be _that_ painful. (Except you'd perhaps need to save the patch client side until the data is processed and the server acknowledges getting it, otherwise you risk losing data on sudden disconnects.)

I work on a Zero Knowledge PGP email service, I think about stuff like this a lot.