The trade-off framing is the honest part. The privacy win is real — no user table to breach, and keys staying in the browser — but the cost that would worry me most is the forgetfulness one: a single cleared browser profile wipes the whole workspace, and the share link carrying the project only helps if someone remembered to make one. For a scratchpad that is a fair deal; for anything I would miss tomorrow, I would want an export I can keep outside the browser. Stating the deal plainly up front, instead of letting people discover it after losing work, is exactly the right way to sell it.