Doesn't matter how you design the architecture. Someone can just force them to "update" their app via the app store, and all of your privacy is gone.