What we never collect

TODO: the explicit "never" list. Things Ostler is architecturally incapable of collecting because the design rules them out:

• Message bodies leaving the device
• Email content leaving the device
• Contact lists, calendar events, browsing history leaving the device
• Microphone or screen recording transmitted off-device
• Behavioural analytics on what the user types into the assistant
• Any form of "fleet learning" or aggregated training data

Each item should explain why the architecture prevents it, not just that we promise not to do it.

Owner: @andy. Cross-reference: the closed-source position (memory/feedback_closed_source.md) – trust comes from independent audit, not from open code.