The closest parallel for me, I think, was the forgot password feature in Mosslet — I chose defaulting it to off because the pure privacy stance is ‘lose your password, lose your data,’ but making it an opt-in toggle for people who want the safety net (which also required another tradeoff between “pure” privacy and trust). To digress a bit, at some point it always comes down to trust.
I also held back public sharing on Mosslet for awhile until I had AI moderation ready — could have shipped the toggle earlier but chose to keep it locked until we could do it responsibly. So I get the instinct to keep N=1 as a hard invariant. For Mosslet I tended to err toward making things opt-in rather than removing the option entirely, but that was due to trying to appeal to a broader consumer base, balancing privacy/security/trust with convenience — because breaking into the social networking market as a bootstrapped SaaS is difficult enough 