How to use AI privately: who can see your chats, and how to stop them

The Morse teamUpdated October 19, 202610 min read

How to use AI privately comes down to two questions: who do you need to keep your words from, and which tool actually stops them? A model running on your own device keeps everything on hardware you control, settings and temporary chats limit training and history, an anonymizing proxy hides who you are, a zero-retention host promises to keep nothing, and end-to-end encryption to a verified secure enclave keeps even the host from reading what you wrote.

No single setting covers all of it. As of October 2026, OpenAI says its staff and service providers may access ChatGPT conversations to improve its models unless you opt out (OpenAI), Google keeps human-reviewed Gemini chats for up to three years (Google), and a federal judge has ruled that a defendant's chats with Claude weren't privileged (Orrick). Each of those is a different audience, with a different fix.

Who can see what you type into an AI chat?

Six audiences come up again and again. Here is what each can see today, from the companies' own pages and the court record.

• The AI company. Regular chats are stored on its servers, often until you delete them. OpenAI says cleared chats are deleted "within 30 days, unless they have previously been de-identified and disassociated from your account or we have to keep them for security or legal reasons" (OpenAI).
• Human reviewers. OpenAI says "a limited number of authorized OpenAI personnel, as well as trusted service providers" may access content to investigate abuse, give support, handle legal matters, or improve its models "unless you have opted out" (OpenAI). Google says "a subset of chats are reviewed by human reviewers" and that reviewed chats "are not deleted when you delete your activity" (Google). A proposed class action, based on 404 Media's reporting on a program called Project Lily, alleges that contractors hired through staffing firms read and graded real ChatGPT conversations; those claims are unproven (Decrypt, September 2026).
• Advertisers. ChatGPT Free and Go have shown ads in the US since February 2026, chosen by default from your conversation topic and past chats, though advertisers get only aggregate numbers like views and clicks (MacRumors). OpenAI expanded them to 31 European countries in August 2026 (OpenAI). Since December 16, 2025, Meta uses your Meta AI interactions to personalize ads, excluding topics like health, religion, and politics (Meta).
• Your employer. On ChatGPT Enterprise, "workspace admins can access an audit log of conversations" through a compliance API (OpenAI), and temporary chats are included for 30 days (OpenAI). On Claude's Team and Enterprise plans, incognito chats "are included in organizational data exports available to account Owners" (Anthropic).
• A court. In 2025 a court order made OpenAI keep ChatGPT logs it would otherwise have deleted; the going-forward duty ended September 26, 2025, with exceptions (Engadget). In January 2026 a judge upheld an order to produce 20 million de-identified ChatGPT logs in the New York Times case (Jones Walker).
• Someone with your device or your links. In United States v. Heppner, the FBI seized about 31 documents recording the defendant's AI chats in a search of his home (Orrick). And in 2025, more than 370,000 Grok chats made with the share button turned up in search engines (Fortune).

For a side-by-side look at the big apps, see our comparison of whether AI chats are private.

Which tool fits which threat?

This table matches each audience to what helps, using the sources above, as of October 2026.

Is running AI locally more private than the cloud?

Yes, for the company side. A local model runs on your own computer, so there is no provider to read, review, train on, or hand over your chats. Ollama's FAQ says: "Ollama runs locally. We don't see your prompts or data when you run locally" (Ollama). LM Studio says "nothing you enter into LM Studio when chatting with LLMs leaves your device," and it can run entirely offline once you've downloaded a model (LM Studio).

The local vs cloud private AI choice has trade-offs. Open-weight models small enough for a laptop are weaker than GPT, Claude, or Gemini, which don't run locally at all. You need the hardware (Privacy Guides lists what each model size needs). And local isn't private from someone with your computer: the history sits on your disk until you delete it. Ollama also offers cloud models now; its FAQ explains how to switch those features off if you want to stay local-only (Ollama).

How do you stop ChatGPT, Claude, and Gemini from training on your data?

If you want AI that doesn't train on your data but still want the big apps, turn off the training setting and use their temporary chats for anything sensitive. Here is what each company says those settings actually do, read on October 15, 2026.

In all three apps, a thumbs up or down can pull a conversation back into the training pipeline you opted out of. If a chat is sensitive, don't rate it.

An opt-out limits what a company does with your chats, but the company still holds them. They do nothing about a court order, an employer's admin console, or a reviewer looking for abuse. Anthropic's chats flagged for breaking its usage policy, for example, can be kept "for up to 2 years" (Anthropic). For the step-by-step on one app, see does ChatGPT train on your data and is Claude private.

Does a VPN or an anonymous AI chat hide who you are?

A VPN hides your IP address, and that's all. If you're signed in, the provider knows exactly who you are, and it still reads every word.

An anonymizing proxy goes further: it sends your message under its own account, so the provider never learns which person sent it. Duck.ai works this way. Its terms say "all metadata that contains personal information (for example, your IP address) is removed before sending Prompts," and that model providers agree not to train on them and to delete them "at most within 30 days, with limited exceptions for safety and legal compliance" (DuckDuckGo, as of October 2026). Morse's Anonymous mode works on the same principle for GPT, Claude, and Gemini: our proxy removes your account, email, and IP address and sends the message under Morse's own account. The provider may keep it for a limited time to check for abuse, under its own policy.

Every proxy has the same limit. The provider still reads the text, and may keep it for a while under its own policy. If you paste your name, your employer, or a document only you have, the words identify you. Anonymity hides only the sender. To keep the message itself from being read, use end-to-end encryption, covered below.

What does zero data retention mean?

Zero data retention (ZDR) is a promise from the host that runs the model. OpenRouter defines it as a provider that "will not store your data for any period of time," and warns that some providers that don't train on your data still retain it for abuse scanning or legal reasons (OpenRouter). ZDR protects you against later exposure, like a breach, a subpoena, or a policy change, because there is nothing left to expose.

ZDR is still only a contract, and you can't check it. You are trusting the host to do what it says. Morse's Private mode, the default for new chats, runs under zero data retention agreements Morse has with its inference, search, and other providers, so they agree to keep nothing. Where a provider confirms zero retention on each reply, Morse checks it and refuses a reply that doesn't; otherwise Morse relies on the provider's commitment.

What is end-to-end encrypted AI, and who offers it?

End-to-end encryption to a secure enclave is the strongest option that still runs in the cloud. The model runs in sealed hardware that even its operator can't look inside. The enclave proves what software it's running, your device checks that proof, and only then encrypts the message so only that enclave can read it. We explain the mechanics in end-to-end encrypted AI chat.

Several services now work this way. Venice launched end-to-end encrypted and enclave modes in March 2026 for 11 open models, run by NEAR AI Cloud and Phala Network (Venice). Since October 15, 2026, Brave Leo has offered end-to-end encrypted chats with GLM 5.3 Flash in a NEAR AI enclave, checked by Brave's own gateway: "Today, your browser relies on the gateway for this check" (Brave). Maple runs open models in enclaves and has iPhone, Android, and desktop apps (Maple). Confer, started by Moxie Marlinspike, says it's built so "nobody has access to your conversations but you" (Confer).

Not every "encrypted" AI is this. Proton says plainly that for Lumo, "we need to provide the LLM with cleartext messages," and calls its scheme "user-to-Lumo (U2L) encryption" rather than end-to-end; its stored history is encrypted so Proton can't read it (Proton).

The costs are the same everywhere: open-weight models only, fewer tools, and trust in the enclave hardware working as designed.

How Morse keeps your AI chats private

Each audience above needs a different fix, and most people end up juggling them: a local model for one question, opt-outs and temporary chats for another, and hoping nothing gets rated by accident. Morse puts the fixes in one web app, and you pick the privacy mode per chat.

• Use GPT, Claude, or Gemini without the provider knowing it's you. Start the chat in Anonymous mode. Our proxy removes your account, email, and IP address and sends the message under Morse's own account, so the provider gets the question with your identity stripped. The provider may keep the message for a limited time to check for abuse, under its own policy, so leave your name and other identifying details out of the text.
• Keep the host from holding on to your words. Private mode, the default for every new chat, runs open-weight models like DeepSeek, Kimi, and GLM, plus xAI's Grok, on hosts that agreed to keep nothing. Where a provider confirms zero retention on each reply, Morse checks it and refuses a reply that doesn't.
• For anything no one should read, start the chat in E2EE. Your browser checks the secure enclave's proof that it's genuine, then encrypts the message so only that enclave can open it. Morse's servers relay text they can't read, and the reply is decrypted only in your browser. Every E2EE reply has a lock you can open to see each check that passed. Third-party providers run the enclaves, not Morse.

The rest of the list is covered in every mode. Morse doesn't train AI on your chats, sell your data, or show ads, so there's no training switch to hunt for and no advertiser reading your topics. Your chat history is stored only in your browser, encrypted with two keys: one that never leaves your device, and one our server gives you when you sign in. It's locked when you sign out, so a copy of your browser data alone can't be read, and a temporary chat is never saved at all, not even on your device.

That also changes what a court can reach. Morse's servers don't keep your messages or log what you write, so as our privacy policy puts it, we "usually" have "very little to give" authorities. The same design means no one, us included, can restore a history you've cleared: clearing the browser or losing the device deletes it for good. For personal questions, use Morse on your own device, away from the work laptop.

Pick the mode that matches who you're keeping out, and ask. Try a chat from the Morse home page without an account, or start free. End-to-end encrypted chats come with Pro, at $19 a month.