And publicly reviewable server code means experts can “verify this privacy promise.”