And here lies the problem - there’s a difference between “we have no process that associates queries and users” and “the system is specifically designed to make this association impossible”.