Aggregation isn’t a privacy guarantee. Here’s what we do instead