Comment by netsharc

I wonder if it's possible to encrypt the index with a key that's copied to the user's device, and if the user wants to turn off this setting, delete the key on the server. When they want to turn it back on, the device uploads the key. Yes, the key might end up gone if there's a reinstall, etc.

If the user leaves it off for a year, then delete the encrypted index from the server...