AI assistants

A hosted assistant runs the language model on the provider’s computers. Your prompt, any files you attach and the reply are processed there as plain text, then usually saved to your chat history. From that point the provider’s policies decide what happens: how long the chat is kept, whether it is used to train the next model, whether people read samples of it, and what it hands over when a court or the police ask. A local model avoids all of this because the prompt never leaves your device.

What "encrypted" means for an AI service

In a messenger, end-to-end encryption (E2EE) means the server only ever handles scrambled data. An AI service cannot work that way: the model has to read your prompt somewhere. If it runs on ordinary servers, "encrypted" only describes the connection (TLS) or the stored chat history. Zero-access encryption of history means saved chats are locked with a key only you hold, but the prompt was still readable while it was being answered. Only when the model runs inside a trusted execution environment (TEE), and your app checks that environment before sending, can the operator be shut out by technical means rather than by promise.

None of these risks is hypothetical. Every item below happened in 2025 or 2026.

• Training and human review. An October 2025 Stanford study of Amazon, Anthropic, Google, Meta, Microsoft and OpenAI found that all six used chats to train models by default; some kept them indefinitely and some let people read transcripts (Stanford HAI). Google keeps human-reviewed Gemini chats for up to three years, even if you delete your activity (Google).
• Court orders. In May 2025 a US judge ordered OpenAI to preserve ChatGPT output logs, including deleted and temporary chats, for the New York Times copyright case. The order stopped applying to new chats from 26 September 2025, but logs already saved stayed preserved (Engadget). In January 2026 a judge upheld an order to hand 20 million de-identified ChatGPT conversations to the news plaintiffs (Bloomberg Law).
• No legal privilege. OpenAI’s chief executive said in July 2025 that chats with ChatGPT have none of the confidentiality of talking to a therapist, doctor or lawyer, and could have to be produced in a lawsuit (TechCrunch).
• Reports to the police. Providers scan chats with automated classifiers. OpenAI said in August 2025 that it sends chats about harming others to human reviewers and may refer imminent threats to law enforcement (Futurism). In September 2026 a Florida woman was charged after Anthropic’s safety systems flagged her messages to its AI platform threatening a sheriff’s office and its reviewers reported them to police; she said she used AI like a diary (WINK News).
• Shared chats in search results. In July 2025 ChatGPT conversations shared with a "discoverable" option showed up in Google; OpenAI removed the option (TechCrunch). In August 2025 hundreds of thousands of shared Grok chats were searchable on Google, Bing and DuckDuckGo (TechCrunch). Meta AI app users published conversations containing home addresses and court details without realising (TechCrunch).
• Ads. Since 16 December 2025 Meta uses conversations with Meta AI to personalise ads and posts in most regions (Meta). ChatGPT began showing ads in its free tier in the US in February 2026, chosen using the conversation’s context, and by September 2026 in more than 40 countries (CTech). Copilot shows ads to people without Microsoft 365. Anthropic said in February 2026 that Claude would stay ad-free.
• Leaks between users. In January 2025 an open DeepSeek database exposed over a million log lines, including chat history and API keys (Wiz). From August to September 2026 a caching bug in Cloudflare’s hosted GLM-5.3 model put fragments of other customers’ prompts into 155 responses (Cloudflare).
• Tools that take more than you expect. In July 2026 the Grok Build coding agent was found uploading whole Git repositories, including old commits with deleted secrets, to cloud storage (The Register).

Memory and connected accounts

Memory features save facts about you (name, job, health, plans) and feed them into later chats. Since August 2025 Gemini has been rolling out personalisation from past chats, on by default for adult accounts, and Copilot keeps saved memories until you remove them. Connected apps go further: linking email, calendar or cloud storage lets the assistant, and therefore the provider, read that data too. Google notes that disconnecting an app does not delete what Gemini already saved from it, and Meta uses AI chats to personalise every account linked in its Accounts Center. Every link you add widens what one subpoena, breach or policy change can expose.

The most private assistant is one that runs on your own hardware: no account, no server, no log, and it keeps working offline. This is possible because many developers publish open-weight models, meaning the trained model file can be downloaded and run by anyone. Current families include Qwen, Gemma, gpt-oss, Mistral, DeepSeek, GLM and Kimi. Open weights are not the same as open source: the training data and training code are usually not published.

The trade-off is hardware. Model size is counted in billions of parameters (7B, 13B, 70B), and the whole model has to fit in memory. Local apps usually download quantised versions, which store the model’s numbers at lower precision so they fit in less memory, at some cost in quality. A model that runs on a laptop is less capable than the largest hosted models, but is often good enough for drafting, summarising, translating and private brainstorming. Privacy Guides suggests these rough minimums:

When your hardware is not enough, these services keep far less than mainstream assistants. They differ in how they protect you. Maple and Confer are built around confidential computing with attestation, so your app can check what the server runs; Venice and Duck.ai offer this for some models. Otherwise these services rely on policies and contracts: no logs, no training, prompts forwarded without your IP address. That is a big improvement on the default, but you cannot verify it from outside, and you still should not paste anything you could not afford to see leaked.

All of these need an account for full use, read your prompts in plain text on the company’s servers, and depend on settings you have to find yourself. They are judged here by the same criteria: whether chats train models by default, how long they are kept, whether people read them, whether they feed advertising, past incidents, and where the company is based.

Use with caution

Not recommended

Agents do more than answer: they browse, click, fill in forms, read your email or run code for you. Examples include AI browsers such as ChatGPT Atlas (launched October 2025) and Perplexity Comet, coding agents, and self-hosted assistants such as OpenClaw that connect to your messaging apps. An agent acts with your logged-in sessions, so anything it can be tricked into doing, it does as you.

The main weakness is prompt injection: instructions hidden in a web page, email, document or code comment that the model reads and obeys as if you had typed them. In 2025 Brave showed that a hidden Reddit comment could make Comet, when asked to summarise the page, fetch the user’s email address and a one-time login code and post them back to the attacker; Brave later found Perplexity’s first fix incomplete (Brave). Simon Willison calls the dangerous combination the lethal trifecta: access to private data, exposure to untrusted content, and a way to send data out. Any agent with all three can be made to leak (Simon Willison).

• Do not run an agent in a browser profile that is signed in to your email, bank, password manager or work accounts. Use a separate profile or browser with nothing in it.
• Avoid giving one agent your private data, the open web and a way to send messages at the same time.
• Turn on confirmation prompts for purchases, logins, sending messages and deleting files, and read what the agent is about to do.
• Do not install third-party agent "skills" or plugins you have not read. Skills for OpenClaw are zip files with instructions and scripts, and can be malicious (Simon Willison).
• Check what coding agents upload. Grok Build sent whole repositories, including old secrets, until a server setting was changed in July 2026.

Before you type

• Never paste secrets. Passwords, API keys, recovery codes, ID and bank numbers do not belong in any hosted assistant. Treat every prompt as something that may be stored for years and read by a stranger.
• Leave out names and identifying details. Describe the situation instead of the person. A question about "a colleague" reveals less than one with a name, employer and town.
• Strip metadata from photos and documents before uploading them; see the metadata guide. Do not upload other people’s photos or private messages without their consent.
• Use a local model for anything sensitive: health, legal matters, sources, finances or your employer’s data.

Settings worth changing

• Turn off training. In Claude, switch off Model Improvement (the "Help improve our AI models" toggle under Settings, Privacy); in Gemini, turn off Keep Activity; in Vibe, turn off "Allow your interactions to be used to train our models"; in ChatGPT, use the data controls in settings. Check again after major app updates.
• Use temporary modes for one-off questions: ChatGPT Temporary Chat (kept up to 30 days), Claude Incognito, Gemini Temporary Chat (72 hours).
• Skip the thumbs up and down buttons. Feedback can override your opt-out: Anthropic keeps the whole rated conversation for five years, Mistral may train on rated exchanges on any plan, and Google may use chats you send as feedback.
• Review memory and connected apps. Delete saved memories you do not want, turn memory off if you do not need it, and disconnect email, calendar and storage you are not actively using.
• Unshare old links. A shared chat is public to anyone with the URL and can end up in search engines. Claude lists them under Settings, Privacy, Shared chats; other assistants have similar pages.
• Delete chats you no longer need, but do not treat deletion as instant or complete: copies may remain for weeks, under legal holds, or in models already trained.

Keep it separate from your identity

• Use a separate account with an email address that is not tied to your name, and do not sign in with Google, Apple or Facebook; see the alting guide.
• Hide your IP address from hosted services with a VPN or Tor where that is legal for you; see the VPN guide. Duck.ai and Brave Leo already strip it before forwarding prompts.
• Pay privately where you can: Kagi accepts cryptocurrency, and Brave Leo Premium uses unlinkable tokens.
• Do not mix work and personal use in one account, and do not paste your employer’s confidential material into a personal assistant.

Common mistakes

• Assuming a paid plan is private. Claude Pro and Max, for example, follow the same training rules as the free plan.
• Trusting the word "encrypted". Ask where the model runs and who can read the prompt while it is being answered.
• Forgetting browser extensions. An extension allowed to read all websites can read your AI chats too; see the browser guide.
• Opening a local model server to the network without a password, or running an outdated local app.
• Pasting text from untrusted sources into an agent without reading it first: that is how prompt injection gets in.

• Privacy Guides: AI chatprivacyguides.orgCriteria for local AI tools and hardware guidance; updated May 2026.
• Stanford HAI: Be careful what you tell your AI chatbot (2025)hai.stanford.eduSummary of a study of six US developers’ privacy policies; the full paper is on arXiv.
• Kagi: LLM privacy comparisonhelp.kagi.comRetention and training terms of the main model providers’ APIs, in one table.
• Simon Willison: The lethal trifecta for AI agents (2025)simonwillison.net
• Brave: Indirect prompt injection in Perplexity Comet (2025)brave.com
• Moxie Marlinspike: Confessions to a data lake (2025)confer.toWhy AI chats reveal more than search history, from the founder of Confer.
• TEE.fail: breaking confidential computing with a memory interposer (2025)tee.fail