Whatever can be resolved inside the device is resolved inside the device.
This is not an ideological stance: the less data that leaves, the less surface there is to protect and the less we have to ask people to trust us.
It is also what lets us in where other tools cannot go. In a health centre, a law firm or a public administration, the conversation does not start with price: it starts with what leaves the machine. If the gesture and the context never leave, there is nothing to negotiate.
When something does have to leave the device, we say so explicitly and explain what for. The formal detail will be in the privacy policy.