From the information presented, the privacy case is not that your data is only accessible to you (which arguably can have a backdoor) but that the data is NOT stored at all, so it's not possible to build a backdoor. I know there are probably other ways around it, but it's my understanding is that no data is kept on any server when the response is sent back to your device