Yes, the appview is a permanent party, but also is responsible for deleting if requested.
PDS hosts and Appview hosts are considered trusted.
It also means someone can build alternate appviews.
I think what you’re aiming for is “private microblogging”. Various other trade offs around who / if anyone can see metadata.
BTW, I don’t call this a sidecar @nonbinary.computer and I think we should reserve that for “sidecar records”, but rather it’s registering a new private data service endpoint.
So, something like
"service": [
{
"id": "#atproto_pds",
"type": "AtprotoPersonalDataServer",
"serviceEndpoint": "https://morel.us-east.host.bsky.network"
},
{
"id": "#atproto_stratos",
"type": "AtprotoStratosPrivateData",
"serviceEndpoint": "https://stratos.northsky.team"
}
]