Factored privacy into default query