You can't leak users' data if you don't hold it