Yep You're right, trusting a server with personal stuff is the hardest part. For the first version, I'm not doing client-side encryption because I just want to test if the idea works. But to earn trust from day one:
I'll open source everything on GitHub so anyone can check the code.
No email, no name, no signup. Just a text box. No account, no IP linked — so even if there's a leak, the text is anonymous.
A script will wipe everything from the server every few hours. Zero trace.
I know it still takes some faith on the server side, but as a solo dev, I want to start transparent and simple. If people find it useful, I'll add better security later.