Distance makes the types grow stronger: a calculus for differential privacy