My high-level understanding of how it works is: Every 20m I generate a key, broadcast it and listen for and record others keys I hear around me. Periodically,

My high-level understanding of how it works is: Every 20m I generate a key, broadcast it and listen for and record others keys I hear around me. Periodically, I ask a server for a list of "infected" keys and compare those keys with what I've seen. If I get infected, I submit my key to the server. The "who's seen who" sounded like it was entirely done locally to your devices. Unless something nefarious is done under the covers, no central server gains access to the information correlation information. What am I missing here? It seems like this system preserves privacy. I exclude nefarious action above because if we believe Google or Apple are acting nefarious (which I understand many do), then they already be doing so at so many levels in our hardware and software that this is just a drop in the bucket.