> All of that data sent to a third party server is going to be public on the Internet at some point.

Windows Recall is on-device only (for now). The captures stay on device in a local sqlite database, and all the processing is done on device on the NPU.