Our privacy page names every single thing that leaves the machine, and it changed how we build.

The rule we set was that "private" is a claim, so it should be checkable. Each app has a page listing every network call it makes, in plain words. If it is not on that list, it does not happen. No account, no login, no telemetry, and not as a setting you switch off, because there is nothing there to switch off.

Writing that page turned out to be a design constraint rather than a documentation task. Every feature now arrives with a question attached. Does this add a line to the page? Anything that did got argued about properly instead of slipping in as a default.

The awkward part is worth reading, the page has to name the things that ARE there. Downloading the language packs you choose is a network call and it is on the list. An optional endpoint you supply yourself, off by default, is on the list. A page that only said "nothing leaves" might be a nicer sentence but most probably would be a false one, and the first person to run a packet capture would be right and we would be finished.

If you claim privacy, write the list before you write the marketing. If the list is embarrassing, that is the feedback. Hope this helps someone.