You can encrypt data on your side and only decrypt it when your users sign in. This is the approach SimpleTax uses in Canada.

Send me an email and I'll be happy to go into more detail. (I'm on a plane which is hopefully taking off soon, so I don't have time to write more right now.)

- "No knowledge" (e.g. decrypted on the client) data storage. Very very difficult to do well.

- Make it easy for people to host data independently of you. Either by running your app on thier server (related to discussion above about for Heroku/Sandstorm, but a regular VPS is probably preferable), or using your client to read data stored in some generic format, e.g. an existing CardDav server, or even just Dropbox, with the web UI running locally, or as an extension.

The most important features for self hosting are probably maturity and stability, and signed releases via an up-to-date PPA.

For using some generic back-end you'd need to support it.

Even if people self-host, if a prosecutor suspected you had data about them meeting they could probably subpoena your server.

That's true of any server or any data. The point is that you control it.

I can't think of any good, practical way to do it.

Theoretically, running the software on a server in Sealand or something like that would put the physical hardware beyond the reach of a subpoena but then, they could lock you up for contempt if you don't give your password to it.

Not really. If it's on your server and not protected by something like the DMCA, you have to turn it over if legally ordered to. Check with a lawyer though.

The DMCA is unlikely to affect a subpoena.