In my opinion if you're running something like this in a location where you might be forced to share the data for such malicious purposes with law enforcement t

In my opinion if you're running something like this in a location where you might be forced to share the data for such malicious purposes with law enforcement then it should be your responsibility to (re-)design the app to provide users with a local-only option for data such that there's then nothing personal on the servers to be requested by law enforcement.