To be fair, even if he did update apache. It's running at linode. One phone call from the feds and they have what want.

Either don't collect anything useful or at least host the server somewhere where a US warrent doesn't as easily work as cutting butter with a hot knife...

The feds, absolutely. Still, there's a lot of other parties that should not have an easy way of accessing the data (if there is any - the joys of closed source implementations).

To have something that is genuinely private and would qualify for listing in the app store, options are pretty limited. I don't think they allow developers to use onion services or anything like that. You could host the server in other countries, but even in hostile countries, it's not a leap of logic to assume the NSA would have an easy time getting in there all without the worry of that pesky "legal" thing.