"Tell me about a time you designed or refactored a system where privacy was an architectural constraint from the start, not a feature added at the end; show the specific decisions made to minimize data collection, keep processing on-device, or protect user consent; connect to the user experience outcome that privacy enabled"

When we built an on-device search feature for user notes, my first architectural decision was that the index never leaves the device. I had a server-side option that would have been faster to build, but it would have required syncing plaintext note content to our servers — data the user never agreed to share. Instead I scoped the problem: what is the minimum the device needs to answer a query locally? We built an inverted index stored in the app's sandboxed container, processed entirely in-memory at query time, with no network call. Result: sub-80ms search with zero data egress. User adoption of search doubled within six weeks of launch because users who had previously avoided the feature — I know this from session analytics — turned it on once we shipped a clear indicator that search was fully local. Privacy wasn't a constraint I worked around. It was the reason the feature worked.