Privacy-preserving sensing