Everything is local only, except:

- when opted in to send diagnostics and performance analytics (to Apple for first party apps and OS, to app developers for third party apps):

> None of the collected information identifies you personally. Personal data is not logged at all, is subject to privacy preserving techniques such as differential privacy, or is removed from any reports before they’re sent to Apple.

> If you agree to send Analytics information to Apple from multiple devices that use the same iCloud account, we may correlate some usage data about Apple apps across those devices by syncing using end-to-end encryption. We do this in a manner that does not identify you to Apple.

- when searching for or suggesting information that's on the web, but none of it is ever linked to the user in any way:

> When you use Siri Suggestions, Look Up and Visual Look Up, when you type in Search, Safari search and #images search in Messages, or when you invoke Spotlight, limited information will be sent to Apple to provide up-to-date suggestions. Any information sent to Apple does not identify you, and is associated with a 15-minute random, rotating, device-generated identifier. This information may include location, topics of interest (for example, cooking or football), your search queries, including visual search queries, contextual information related to your search queries, suggestions you have selected, apps you use, and related device usage data. This information does not include search results that show files or content on your device. If you subscribe to music or video subscription services, the names of these services and the type of subscription may be sent to Apple. Your account name, number and password will not be sent to Apple.

> This information is used to process your request and provide more relevant suggestions and search results, and is not linked to your Apple ID, email address or other data Apple may have from your use of other Apple services.

> Aggregated information may be used to improve other Apple products and services. Common search queries may be shared with a web search engine to improve search results.

(emphasis mine)

One could argue that there's enough bits of data to deanonymise after the fact, but differential privacy should prevent that to a large extent.

There are also toggles to disable all of that, with possible improvements to usability:

- Some onboarding opt-in/out questions could definitely be improved (e.g the "Ask Siri" onboarding question should either cover all of Siri-the-voice-assistant, Siri-but-actually-Spotlight and Siri-the-suggestion-assistant-that-hints-at-actions-based-on-content-and-behaviour, or be split in three).

- Some grand-master "disallow the OS to see ANYTHING" switch seems to be requested by the most ardent "privacy minded" crowd. I'd argue that at this stage it's more about "privacy paranoid" and/or "security minded" (which I can very much be sympathetic to), because it's not a matter of privacy here since none of the above is privacy challenging: Apple itself does not see anyone's data, and the few search queries it can is entirely unlinked to anyone's id. But then again if you don't trust the locally-processing OS made by Apple (which is going to have access to data anyway because it handles the filesystem and app processes) then I have a surprise: the CPU made by Apple is seeing your data as well.