If they don‘t upload there is no information anywhere, but on your device. The system very much depends on the cloud, because the keys of known photos aren‘t stored locally. Photos are already scanned locally for the keyword search and faces,and that could easily be used to search for anything, but so far no one had an issue with that.