The Architecture of Privacy