Ask HN: How to build a privacy/security conscious WebApp?

I have been asked to build a WebApp for an NGO. What does this imply in the analytic/design/technology choices phases? (I guess 3rd party analytic are out, but what else ?)