Rankings · AI Assistants

Which AI can you trust with what you type?

Every consumer assistant, judged on privacy alone — what the company does with what you type, on its normal setting. Start with the one question that splits them, then read the full table. New here? Start with the test below.

A ground rule for this page: we rank these tools on privacy only — what each company does with what you type. An institutional deal doesn't count here. (Pitt's enterprise agreement with Anthropic is real and worth using, but that's a campus thing, not a point in Claude's favor on the open market.)

Set the deals aside and most consumer AI lands in the same place. Paying $20 a month doesn't fix it: personal Plus and Pro plans usually still train on you. The tiers that don't are enterprise/education accounts (contractually excluded) and models you run yourself (nothing leaves your device).

The test

How to judge any AI on privacy

The questions that actually matter — the same ones we apply to everything else. Run any tool, new or old, through these.

  • Trained on your chats by default? On consumer plans, usually yes. That's the first thing to check and change.
  • Is there a real opt-out? And is it honest, or a buried toggle designed so you never find it?
  • How long is data kept? Retention runs from ~30 days to several years — even after you hit delete.
  • Do humans read it? Many services let staff or contractors review conversations for "safety."
  • Is it wired into an ad or data empire? A chatbot owned by an ad company feeds the same profile as your searches and email.
  • What jurisdiction, and can you self-host? Where the servers sit decides who can compel the data — and open-weight models can skip the cloud entirely.

Same standard we hold everywhere — see how we evaluate what we publish.

A note on Gmail. Google’s “Smart Features” — which power autocomplete, category sorting, suggested replies, and Gemini’s ability to summarize your inbox — scan your email content by algorithm. This isn’t new: it has worked this way since roughly 2014. Google says[1] Gmail content is not used to train its general-purpose Gemini model; the scanning is for personalizing your own experience. In November 2025 Google added an opt-in Gemini Deep Research mode that can pull from your Gmail, Drive, and Calendar, but that requires a separate choice. The honest summary: Gmail scans every message algorithmically by default; no one at Google reads your email; your content shapes your profile but (per Google) doesn’t train the shared model. If any of that bothers you, Smart Features is a toggle — Settings → See all settings → General → Smart features and personalization → off. The trade-off is losing suggestions and Gemini sidebar access.

The field

Where does your prompt actually go?

One question splits every AI apart. If what you type never leaves your device, privacy is simply a fact. The moment it reaches a company, you're left with a promise — or, at best, a promise you can check. And once it's with a company, the law protects it far less than what stays on your device — that's the third-party doctrine.

Show
ServiceSees who you areTrains by defaultOpt-outAdsRetentionJurisdiction
On your deviceThe model runs on your machine — nothing is sent, so nothing else applies.
Janlocal · open sourceNo—————
Ollamalocal runnerNo—————
llama.cpplocal engineNo—————
GPT4AllNomic · localNo—————
LM Studiolocal appNo—————
Open WebUIself-hosted UINo—————
Odysseusself-hosted workspaceNo—————
VerifiableA secure enclave lets you cryptographically confirm the company can’t read your prompt.
Tinfoil15secure enclave · USNoNo——NoneUS · enclave
Apple PCC14Apple · enclaveNoNo——NoneUS · enclave
Brave Leo (TEE)13Brave · NEAR AINoNo——NoneUS · enclave
Confer20Moxie Marlinspike · enclaveNoNo——Encrypted onlyUS · enclave
Doesn’t see youAn anonymizing proxy strips your identity before the model ever sees the prompt.
Duck.ai12DuckDuckGo · USProxied12No—NoLocal / 30 dUS
Kagi Assistant11Kagi · USProxied11No—No~1 dayUS
Brave Leo13Brave · USProxied13No—NoNone / 30 dUS
Venice21Venice · USProxied21No—NoLocal / noneUS
Sees you, won’t trainTied to your account, but pledged not to train — under EU or Swiss law.
Proton Lumo9Proton · SwitzerlandYesNo—NoNoneEU / Switzerland
Infomaniak Euria10Infomaniak · SwitzerlandYesNo—NoNot statedSwitzerland
Trains by default — you can opt outMainstream assistants: training is on until you find the toggle.
Claude2Anthropic · USYesYesYesNo30 days / 5 yrUS
ChatGPT1OpenAI · USYesYesYesNo30 daysUS
Perplexity6Perplexity · USYesYesYesNoUntil you deleteUS
Grok5xAI · USYesYesYesNo30 daysUS
Mistral Le Chat8Mistral · FranceYesYesYesNoUntil you deleteEU · France
Gemini3Google · USYesYesYesNo1818 mo / 3 yrUS
Muse19Meta · USYesYesYesNoNot statedUS
Trains, and feeds ad profilesSame as above, wired into an advertising system.
Copilot4Microsoft · USYesYesYesYes418 monthsUS
Meta AI7Meta · USYesYesNoYes7IndefiniteUS
Alexa+22Amazon · USYesYesYesYes22Until you deleteUS
Trains, no opt-out, foreign lawConsumer Chinese assistants, under China’s security laws.
Eight Chinese assistants17DeepSeekQwenErnieDoubaoHunyuanGLMKimiYiYesYesNoNoIndefiniteChina · Beijing

No services match that filter.

How to read this. Judged on privacy alone, on each service’s ordinary consumer setting — a pitt.edu login, or any enterprise or education account, is usually far more private than what’s shown here. Sees who you are — whether the service can tie what you type to your identity: No (nothing leaves, or an enclave it cannot read), Proxied (an anonymizing relay hides you from the model host), or Yes. Trains by default is what happens if you change nothing; Opt-out is whether you can turn training off. Ads flags a service wired into an advertising profile. Retention is how long what you type is kept; two values mean default / exception, so Claude’s “30 days / 5 yr” is 30 days if you opt out of training and five years if you don’t. Jurisdiction is whose law can compel the data. A dash (—) marks a question that doesn’t apply because nothing leaves your device. The eight Chinese assistants are grouped: under China’s National Intelligence, Cybersecurity, and Data Security laws their consumer defaults and reach are effectively identical. Each service links to its source below. The Sees who you are and Ads columns are read from that same per-service source; the notable calls — “Proxied,” and which services feed ad profiles — carry their own reference.Last reviewed July 12, 2026 — terms and policies change often; verify current details before relying on this. General information, not legal, financial, or tax advice.

Sources & notes

Every service above carries a number linking to its source here. On-device tools (Jan, Ollama, llama.cpp, GPT4All, LM Studio, Open WebUI, Odysseus) run the model on your own machine; nothing is sent to a provider, so training, review, retention, and jurisdiction don't apply — the dashes in those rows are structural, not missing research. Consumer defaults are shown; enterprise, education, and API tiers are typically far more private.

  1. OpenAI · ChatGPT — consumer chats (Free, Plus, Pro) train the model unless you turn off “Improve the model for everyone” in Settings → Data Controls; deleted chats and Temporary Chats are purged within 30 days, and staff and vetted contractors may review conversations for safety and model improvement. openai.com
  2. Anthropic · Claude — since its 2025 consumer-terms change, Free/Pro/Max chats train Claude unless you switch off “Help improve Claude”; retention is 30 days if off and up to five years if on, only safety-flagged chats are human-reviewed, and Claude is ad-free with no data sold. anthropic.com
  3. Google · Gemini — Gemini Apps Activity is on by default and used to improve models with routine human review; turning it off stops both. Default retention is 18 months (72 hours even when off), but conversations seen by human reviewers are kept up to three years. support.google.com
  4. Microsoft · Copilot (personal account) — consumer Copilot trains on your conversation activity unless you opt out, some chats get automated and human review, history is kept 18 months, and it is tied to Microsoft's advertising ecosystem. This is the consumer product at copilot.microsoft.com, not Microsoft 365 Copilot Chat on a work or school account (see On Campus). support.microsoft.com
  5. xAI · Grok — on grok.com, conversations train Grok by default with an opt-out in Settings → Data Controls; staff may review chats for safety regardless of that setting, and deleted chats are removed within about 30 days. x.ai
  6. Perplexity — “AI Data Retention” is on by default for Free, Pro, and Max and can be turned off in Settings; chats are kept until you delete them, and deleting your account purges data within 30 days. perplexity.ai
  7. Meta · Meta AI — Meta’s Privacy Policy (effective July 23, 2026) counts what you exchange with its AI features as part of your activity and says it uses that activity to personalize your feeds, Meta AI and ads; it keeps information case by case rather than for a set time. Interactions are also used to train Meta’s models, and there’s no simple off switch: you can only file an objection that Meta reviews. Meta privacy policy · cloaked.com
  8. Mistral · Le Chat — free and consumer chats train Mistral's models by default with an opt-out under Data & Account Controls → Privacy; conversations are kept until you delete the chat or your account; the company is French and operates under the GDPR. legal.mistral.ai
  9. Proton · Lumo — no server-side logs and no training; saved chat history is zero-access encrypted so only you can open it, on European infrastructure under Swiss law. proton.me
  10. Infomaniak · Euria — a Swiss-hosted assistant that pledges never to use your exchanges for training and keeps data in Switzerland under the GDPR and Swiss law; protection is contractual rather than end-to-end encrypted, so Infomaniak can technically access chats. infomaniak.com
  11. Kagi · Assistant — does not train on your conversations, does not pass your identity to the model providers, and acts as an anonymous proxy; threads are deleted after about a day by default. wysor.io
  12. DuckDuckGo · Duck.ai — strips your IP and identifying metadata before forwarding your prompt; provider contracts forbid training and cap retention at 30 days, and your chat history stays in your browser. how2shout.com
  13. Brave · Leo — requests are routed through an anonymizing proxy, not stored on Brave's servers, and not used for training (a provider such as Anthropic holds queries about 30 days); the TEE option adds a verifiable secure enclave. brave.com
  14. Apple · Private Cloud Compute — stateless computation that retains nothing after a request, with no privileged access and verifiable transparency that outside researchers can check. security.apple.com
  15. Tinfoil — runs models inside attested secure enclaves, so prompts and completions are never logged or accessible to Tinfoil, its cloud providers, or subprocessors, and clients cryptographically verify the code on every connection. tinfoil.sh
  16. DeepSeek — trains on inputs by default with no meaningful opt-out; data is stored on servers in China and kept as long as your account exists, with no fixed deletion schedule. deepseek.com
  17. Chinese providers · jurisdiction — DeepSeek, Qwen, Ernie, Doubao, Hunyuan, GLM, Kimi, and Yi operate under China's National Intelligence Law (2017), Cybersecurity Law, and Data Security Law, which can compel disclosure to authorities; consumer versions generally train on inputs and moderate content, and individual retention windows are often unpublished. proton.me
  18. Google · Gemini and ads — Google states that data from connected Google apps can personalize ads based on your settings, but that your Gemini app chats themselves are not used to show you ads. cape.co
  19. Meta · Muse — launched September 8, 2026; checked against the Muse Supplemental Terms of Service (September 8) and the Muse Privacy Policy (effective September 17). Training on your interactions, including what Muse pulls from connected apps, is on when you start; a switch under Data controls turns it off, for past chats too. The policy keeps your conversations and the files in Muse’s cloud computer out of Meta’s ad systems, even if you link Muse to your Facebook or Instagram accounts. That promise doesn’t name the activity Meta also collects, like sites Muse visits and purchases, and linking lets Meta combine the rest of your information across its products. No retention period is published — Meta’s main privacy policy, which also covers Muse, decides case by case — deleting something doesn’t make Muse forget what it learned from it, and the terms let Meta monitor and keep logs of everything Muse does. A TIME investigation found Muse builds profiles of the people you deal with, including people who don’t use it. muse.ai/terms · muse.ai/privacy · Meta privacy policy · time.com
  20. Confer — made by Moxie Marlinspike, who created Signal; public since January 2026. Checked against its Terms of Service (November 2025) and Privacy Policy (October 2026): messages are end-to-end encrypted before they leave your device, your history is stored only in encrypted form that you alone hold the keys to, and Confer says it can’t read your messages or give them to anyone. It doesn’t train AI on your conversations and doesn’t sell, rent or otherwise make money from your data. You register with an email address (through Google or Apple sign-in), which it says it uses only to log you in, and it doesn’t keep anything from connected Google apps. Disputes go to courts in Delaware. Answers are generated inside a secure enclave your browser checks before sending anything, and that code is open source. confer.to · techcrunch.com
  21. Venice — started by Erik Voorhees in 2024. Your chat history stays in your browser, and prompts pass through Venice’s relay without being stored. In the default Private mode the models run on Venice’s own GPUs or on partners bound by zero-retention contracts — a promise, not something you can check. Choosing a frontier model (GPT, Claude, Gemini) switches to an Anonymous mode where that provider likely keeps your prompt. Paid Pro plans add enclave and end-to-end encrypted modes you can verify. No account is needed, and the service is hosted in the US. venice.ai/privacy · venice.ai privacy policy
  22. Amazon · Alexa+ — the Alexa Terms of Use (updated February 25, 2026) say Amazon records, processes and keeps your Alexa interactions in the cloud — voice and typed requests, shopping lists and history, and linked services like your email — to provide, personalize and improve its services. Amazon’s Alexa FAQ says recordings are used to improve its services unless you turn that off, that your interactions may also improve other Amazon products, that ads on Alexa can be interest-based, and that with Alexa+ information from your interactions may be shared with skill developers. Amazon’s Privacy Notice lists Alexa interactions among what it collects and says it uses personal information for interest-based ads. A 2023 study led by University of Washington researchers found Amazon infers ad interests from what people ask Alexa, even though its policies don’t say so outright. Recordings stay until you delete them, and Amazon told the US Senate it may keep other records of your requests after that. Alexa terms · Alexa FAQ · Amazon privacy notice · the study · coons.senate.gov

The spectrum

Everyday to airtight

Same shape as the rest of our Tools: start where you are, move up as the stakes rise.

Everyday

Cloud AI, tightened

Keep using the big tools, but turn training off in settings, use temporary/incognito chats for anything sensitive, and never paste what you'd hate to see leaked.

Reduces the leak. Doesn't close it.

More private

Enterprise tier or a proxy

Enterprise, education, and Team accounts are contractually excluded from training — this is exactly what a Pitt login buys you (see On Campus). Or use a front-end like DuckDuckGo's AI Chat that proxies your request so the model host never sees who you are.

Maximum

Run it yourself

Load an open-weight model on your own machine with Ollama or LM Studio — Llama, Mistral, Qwen, Gemma. Nothing leaves the device, so there's nothing to train on, retain, subpoena, or leak.

The trade-off: laptop-sized models are weaker than the frontier, and the strong ones want a real GPU. Maximum privacy, not maximum power.

The other kind of training

If you make things, you can fight back

Everything above is about your chats. But the same models train on scraped images — artists keep finding their work in training sets like LAION-5B with no consent, credit, or pay, then watch it used to mimic their style on demand. Two free tools from the University of Chicago’s SAND Lab let creators push back.

Defensive · cloak your style

Glaze[2]

Adds changes invisible to your eye that make AI models read your piece as a completely different style, so a model fine-tuned to copy you learns the wrong thing. It runs on your own machine and sends nothing back. WebGlaze[3] is a free, invite-only web version for phones or computers without a GPU.

Offensive · poison the scrape

Nightshade[4]

Alters an image so a model that scrapes it learns the wrong associations — a poisoned dog reads as a cat. The goal isn’t to break models; it’s to make training on unlicensed work costly enough that paying to license it becomes the easier path.

Neither is permanent — it’s an arms race, and the team updates both as new attacks appear. Think of them as a stopgap while the law catches up, not a guarantee. Sources: SAND Lab — What Is Glaze[5] · MIT Technology Review on Nightshade[6].

References6 sources

Every source this page cites, numbered in the order it first appears. Each number in the text links here; each ^ links back.

  1. ^ Google Account Help, support article 10130420 support.google.com/accounts/answer/10130420
  2. ^ University of Chicago SAND Lab, Glaze glaze.cs.uchicago.edu
  3. ^ University of Chicago SAND Lab, WebGlaze glaze.cs.uchicago.edu/webglaze.html
  4. ^ University of Chicago SAND Lab, Nightshade nightshade.cs.uchicago.edu
  5. ^ University of Chicago SAND Lab, “What Is Glaze” glaze.cs.uchicago.edu/what-is-glaze.html
  6. ^ MIT Technology Review, on Nightshade and artists poisoning AI training data, Oct. 23, 2023 technologyreview.com/2023/10/23/1082189/data-poisoning-artists-f…

Get involved

It’s free, open to everyone at Pitt, and joining takes about a minute.

No dues, no experience needed. Come to a meeting, or leave your name and we’ll tell you when the next one is.

Join the club See upcoming meetings →