The strongest privacy policy may be a system that never sends the data.
Not a stronger promise. A shorter path.
Google has released a version of Gemma 4 tuned to run natively on the Pixel 10's TPU: offline conversation, image recognition, audio transcription, and device actions, with no round trip to a cloud model. It runs at roughly 2.3 billion effective parameters, across the whole Pixel 10 line.
That matters because privacy is usually discussed as paperwork — retention terms, consent screens, vendor promises, deletion requests. Those controls are necessary, but architecture can remove part of the problem before policy has to manage it. If sensitive audio, images, and routine commands stay on the device, there is less data to govern, leak, subpoena, retain, or accidentally train on.
Local inference is not automatically private. The app can still log, sync, expose endpoints, or ask for permissions it does not need. Small devices impose real capability limits, and the vendor's own claim that data never leaves the device is a claim about the model, not about the app around it.
But where inference happens is now a first-class product and governance decision — not an implementation detail.
Privacy by topology is harder to write down than privacy by policy. It is also harder to violate by accident.