AI privacy policy changes: what 13 apps promise to tell you

The Morse teamPublished October 30, 202612 min read

Most AI privacy policy changes come with no promised warning. Of the 13 AI apps whose privacy policies we read on October 30, 2026, only three promise to tell you before a change takes effect: Meta and Microsoft for material changes, and Replika for any change. None of the three says how many days ahead. Four more promise some notice of material changes without saying when, and six promise only to post the new version and date, or nothing at all.

We read the "changes to this policy" clause in each app's current privacy policy that day, plus its terms of service where the policy points to them or where the terms say more. For each app we wrote down the date on the policy, how it says it will tell you about a change, how much warning it promises, whether continuing to use the app counts as accepting the change, and whether it links to past versions. Every cell links to the page it came from. Perplexity's privacy policy didn't load for us on October 30, so it isn't in the table. What the apps changed about training, such as Anthropic's switch in 2025, is covered in which AI companies train on your data.

Google is ahead on the record. Its privacy policy archive goes back to June 1999, with a page that marks what each version added and removed.

Which AI apps tell you before their privacy policy changes?

Read on October 30, 2026, from each company's own privacy policy, and its terms where noted.

Six of the 13 link to full past versions of their policy: OpenAI, Anthropic, Google, Meta, xAI, and Mistral. Microsoft publishes summaries of each change. The other six link to nothing older than the page you're reading.

How will I know if a privacy policy changes?

Usually by checking the date yourself. Six of the 13 policies promise only a new version and date on the page (OpenAI, xAI, DeepSeek, and Duck.ai) or nothing at all (Mistral and Lumo). Duck.ai adds a message at the top of the page for substantive changes, which you'll see only if you open the page.

Three policies put the checking on you, with no notice promised: Mistral's ("Make sure to check this Privacy Policy frequently"), Lumo's ("you are responsible for regularly reviewing this Privacy Policy"), and DeepSeek's ("We recommend that you review the Privacy Policy each time you access our Services").

The apps that do reach out describe it differently. Anthropic notifies you of material changes "as appropriate." Google sends email "for certain services" when a change is significant. Character.AI says notice may come "by email or prominent posting." For its 2025 training change, Anthropic showed existing Claude users a pop-up and gave them until October 8, 2025 to choose (Anthropic). Our page on whether Claude is private covers what that change did.

Do companies have to notify you of privacy policy changes?

In some cases. In February 2024 the FTC wrote that it "may be unfair or deceptive" for a company to start using consumer data in new ways, such as "for AI training," and tell people only "through a surreptitious, retroactive amendment to its terms of service or privacy policy" (FTC). It pointed to its case against Gateway Learning, which changed its privacy policy to share customer data "without notifying consumers or getting their consent."

In Europe, the GDPR transparency guidelines last revised in April 2018, and endorsed by the European Data Protection Board, say changes should reach people "by way of an appropriate modality," such as an email, a letter, or a pop-up on a webpage, and that telling users to regularly check the policy for changes is "considered not only insufficient but also unfair" (Article 29 Working Party, EDPB). For a fundamental change, such as new recipients of your data, the guidelines say you should hear "well in advance of the change actually taking effect."

This isn't legal advice.

Does continuing to use an AI app mean you accept the new policy?

In most of these apps, yes. Three privacy policies say so outright: xAI's says the changes "will apply" once you use Grok after they're posted, Duck.ai's calls continued use "your consent and agreement," and Lumo's says it "shall constitute your consent." Character.AI's says that by continuing you confirm you've "read and understood" the new version.

The terms say it more often. The terms of Anthropic, xAI, DeepSeek, and Microsoft's Copilot all treat using the service after a change as agreeing to it, and Meta's AI terms say you're bound "if you continue to use our AIs." Microsoft's Services Agreement says the same, and its current version was published July 30, 2026, two months before it took effect on September 30 (Microsoft).

Why do the terms promise more notice than the privacy policy?

Every 30-day promise we found sits in an app's terms and covers changes to those terms. OpenAI's terms give "at least 30 days advance notice of changes to these Terms that materially adversely impact you either via email or an in-product notification," while its privacy policy promises only to post the new version. Mistral's terms make the same 30-day promise, and its privacy policy makes none. Copilot's terms are posted "at least 30 days before they take effect," apart from "rare circumstances." Google's terms promise "reasonable advance notice" of material changes (Google terms), and its privacy policy names no period.

The notice period in an app's terms doesn't apply to its privacy policy, so read the clause in the policy itself.

What changed in ChatGPT's, Grok's, and Gemini's latest privacy policies?

We compared each current version with the one before it on October 30, 2026.

• Grok, October 27. Line by line against the October 11 version, the only changes we found were the company's name in the opening ("SpaceXAI LLC" became "SpaceX Super Intelligence LLC") and the company named for privacy requests ("x.AI LLC" became "SpaceX Super Intelligence LLC"). The European guidelines list a change in the identity of the company that controls your data among the changes that "should always be communicated." We can't tell from the policy whether this is a new company or a new name for the same one, and xAI's policy promises only to post either. Is Grok private covers what xAI keeps.
• ChatGPT, September 10. Against the May 18 version, "We may receive information from advertisers" became "We receive information from advertisers and other data partners," now used "to help us measure and improve the effectiveness of our Services, including ads shown to Free and Go users." Mentions of Sora and the Atlas browser were removed. Our guide to ChatGPT's ads has the settings.
• Gemini, October 16. Google's comparison page marks new text saying you can let services "like Search or Gemini Apps" access data from "Google Photos and Workspace apps like Gmail and Drive," with an example of Search using booking details from an email (Google).
• Claude, September 10. Anthropic's change log has no summary for this version yet, so we can't say what changed; is Claude private covers Anthropic's earlier changes.

How do you find an old version of a privacy policy and compare it?

Start at the date at the top of the current policy. In the apps that keep an archive, the link is next to it.

1. Google: click Archived versions next to the effective date. On the Updates page, choose Comparison beside any date, and Google marks what that version added and removed.
2. Meta: click See previous versions next to the effective date, then View this version beside any date.
3. ChatGPT and Grok: click Previous version (OpenAI) or previous version (xAI) next to the date. Each old version has the same link, so you can step back one version at a time.
4. Mistral: open the Versions menu above the policy for PDFs of past versions.
5. Claude: open "Updates to our Privacy Policy" in Anthropic's Privacy Center for summaries and links to old versions.
6. Microsoft: follow the policy's link to its Change history page for a summary of each month's changes.

Only Google compares versions for you. For the others, copy the text of both versions into a text-comparison tool, which is how we found the Grok and ChatGPT changes above. For the six apps with no archive, save a copy of the policy page (print it to PDF) when you sign up, so you have something to compare against later. How to download your AI chat data covers getting a copy of what the company holds.

How Morse keeps your chat history off its servers

A privacy policy governs what a company already holds. A change posted today can reach chats you sent last year, unless the company says otherwise. That retroactive reach is what the FTC warned about. Morse keeps your chat history off its servers instead. Your chat history is stored in your browser, encrypted, not on Morse's servers, and our servers don't keep your messages or log what you write. The account holds your sign-in details, plan, balance, and a usage ledger with no content (privacy policy).

Morse doesn't train AI on your content, sell your data, or show ads, so there's no training switch to keep an eye on.

Each message still goes to a model, and the privacy mode you pick for the chat decides who sees it:

• Private, so there's no stored copy for a later policy version to reach. It's where a new chat begins, and it runs Grok and open-weight models like GLM, Kimi, and DeepSeek. The hosts that run them agreed to keep nothing, under the zero data retention agreements Morse has with its inference, search, and other providers. For providers that confirm zero retention on each reply, Morse checks every confirmation and refuses a reply without one.
• E2EE, so the message is sealed before any server handles it. Before anything leaves your device, your browser verifies the enclave's hardware proof and encrypts the message for that one enclave. What passes through Morse is ciphertext our servers can't read, and the reply is encrypted again and opened only in your browser. This depends on the enclave hardware and attestation working as designed. E2EE is part of Pro, at $19 a month.
• Anonymous, so a provider's new clause covers a request with no account of yours behind it. For GPT, Claude, and Gemini, our proxy strips your account, email, and IP address and sends the message under Morse's own account. The provider reads it without knowing it's you, and may keep it for a limited time to check for abuse, under its own policy. That policy can change like any in the table above, so keep your name and anything that identifies you out of the message.

In every mode, history locks when you sign out and takes two keys to open, one of which never leaves your device. Because your device holds the only copy of your history, Morse can't recover a chat once you clear your browser or delete your account, so save your own copy of anything you'll want later, as you would an old version of a policy.

You can try Morse from the home page before making an account, and the Free plan asks for no card.