I think encryption at rest for account data should be a thing, but there are better ways to communicate and organize if that’s what you’re trying to do

I think the biggest thing would just be making sure that it’s not easy for the government to get user data. So making signups without personally identifiable info would potentially be worthwhile, so that info can’t just be subpoenaed to identify users irl