Interestingly I'd probably go the other way. If it's verifiably E2EE then I consider "we can't access this" to be a fairly powerful statement. Sure, the source

Interestingly I'd probably go the other way. If it's verifiably E2EE then I consider "we can't access this" to be a fairly powerful statement. Sure, the source could change, but if you have a reasonable distribution mechanism (e.g. all users get the same code, verifiably reproducible) then that's about as good as you can get. Privacy policies that state "we won't do XYZ" have literally zero value to me to the extent that I don't even look at them. If I give you some data, it's already leaked in my mind, it's just a matter of time.