Is DeepSeek safe? The app, the open weights, and where your chats end up

The Morse teamPublished October 19, 20267 min read

As of October 2026, DeepSeek's app and website are safe only for things you're comfortable having stored in China: DeepSeek's own privacy policy says it collects, processes, and stores your data in the People's Republic of China, keeps your input for as long as you have an account, and may use it to train its models unless you opt out. DeepSeek's open-weight models are a different product. They're free to download under the MIT license and run on anyone's hardware, and when they run somewhere else, DeepSeek's servers never see the chat.

We read DeepSeek's privacy policy (last updated February 10, 2026), its terms of use (March 27, 2026), its notes on how it trains models, and its model pages on Hugging Face on October 19, 2026, along with the government documents cited below. DeepSeek deserves some credit. It publishes its weights under the MIT license, which lets anyone download, change, and run them, and it gives you a training opt-out in plain view. The app and the weights still need separate answers.

DeepSeek's app at a glance

What does the DeepSeek app collect about you?

Everything you type or upload, plus the usual device data. DeepSeek's privacy policy lists your "text input, voice input, prompt, uploaded files, photos, feedback, chat history," your device model, operating system, IP address, device identifiers, and system language, and an approximate location worked out from your IP address. It assigns you a device ID and a user ID and uses them to link your activity across devices. It says it won't extract voiceprints or facial recognition data from what you upload, and it asks you not to share sensitive data like health details, religious beliefs, or immigration status at all.

One claim about DeepSeek is out of date. When we searched on October 19, 2026, the AI answer at the top of Google's results said DeepSeek gathers "keystroke patterns." Its December 5, 2024 policy did list "keystroke patterns or rhythms" among device data (archived copy). The February 14, 2025 version dropped the phrase (archived copy), and the current policy doesn't mention keystrokes.

Does DeepSeek train on your chats?

Yes, unless you turn it off. DeepSeek's terms say it may use inputs and outputs "to provide, maintain, operate, develop or improve the Services," after "strict de-identification," and that you can opt out "by turning off 'Improve the model for everyone.'" Its training notes say the question-and-answer data it builds for fine-tuning comes mostly from its research team, "with a small portion potentially based on user input." De-identification strips who you are, not what you wrote, so a chat that names your employer or your doctor still names them.

How long does DeepSeek keep your chats, and who can get them?

As long as your account exists, unless you delete them. The privacy policy says DeepSeek keeps your account data, input, and payment data "for as long as you have an account," and longer when it has "a legitimate business interest" or a legal obligation. You can delete chats in settings.

The policy names three groups that can receive your data:

• DeepSeek's corporate group, for "storage, content delivery, security, research and development, foundation model training and optimization."
• Service providers, including third-party search APIs that receive "your input keywords" when the app searches the web.
• Law enforcement and public authorities, when DeepSeek believes it's needed to "comply with applicable law, legal process or government requests."

The terms put disputes under "the laws of the People's Republic of China," heard by a court where Hangzhou DeepSeek Artificial Intelligence Co., Ltd. is registered. So your chats sit on servers in China, and a dispute with DeepSeek goes to a Chinese court under Chinese law. Most DeepSeek privacy concerns start there.

Which governments have acted on DeepSeek?

Italy and Australia did in early 2025, and a US agency tested its models later that year. Each of these has its own government document:

• Italy, January 30, 2025. Italy's data protection authority ordered, "in via d'urgenza e con effetto immediato," a limit on DeepSeek's processing of Italian users' data, and opened an investigation after DeepSeek's companies said they didn't operate in Italy, an answer the authority called "del tutto insufficiente" (completely inadequate) (Garante).
• Australia, February 4, 2025. A protective security direction requires Australian Government entities to "prevent the access, use or installation of DeepSeek products, applications and web services" and remove existing ones from government systems and devices (Australian Government). It applies to government systems and devices, not to private citizens' phones.
• United States, September 30, 2025. NIST's Center for AI Standards and Innovation tested DeepSeek R1, R1-0528, and V3.1 against US models. It found that DeepSeek models "echoed four times as many inaccurate and misleading CCP narratives" as the US reference models, and that, with a common jailbreaking technique, R1-0528 answered 94% of overtly malicious requests, against 8% for the US models (NIST). NIST tested those 2025 models, not DeepSeek's current V4 family.

Is DeepSeek safe to run locally?

Yes, as far as privacy from DeepSeek goes, if you have the hardware. DeepSeek says it releases "all model weights, parameters, and inference tool code" under the MIT license (DeepSeek). Its newest models are on Hugging Face: DeepSeek-V4.1-Flash, updated October 16, 2026, has 552 billion backbone parameters, handles up to one million tokens, and comes with commands to serve it with vLLM or SGLang.

DeepSeek's own privacy policy draws the line. It covers DeepSeek's "apps, websites, software, and related services," and it says apps that developers build on DeepSeek's platform answer to their own privacy policies, not DeepSeek's. Weights are files. Run them on your machine, or on a host you choose, and your prompt goes to whoever runs them.

Running the weights elsewhere changes who sees your prompt. It doesn't change how the model was trained, so NIST's findings about how the models answer still belong in your decision, whoever hosts them. A model this size also needs server-class hardware, so unless you have a server, you'll need a host that runs it for you. We compare the options in our guide to using AI privately.

How to use DeepSeek without DeepSeek's servers

Every privacy concern above comes from one place: DeepSeek's app sends your chat to servers in China, tied to your account, under a policy that keeps it as long as the account exists. Morse runs DeepSeek's open weights instead of DeepSeek's app, so the app's servers never see the chat.

• Private, for DeepSeek without DeepSeek's app. Private is the default for a new chat. It sends open-weight models like DeepSeek, Kimi, and GLM to hosts that agreed to keep nothing. Where a provider confirms zero retention on each reply, Morse checks it and refuses a reply that doesn't; otherwise Morse relies on the provider's commitment. There's no DeepSeek account to make, no training toggle to find, and no chat history left in DeepSeek's app.
• E2EE, for anything you wouldn't hand to any host. Open-weight models like DeepSeek, GLM, and Kimi also run in secure enclaves, which third-party providers operate, not Morse. Your browser checks the enclave's hardware attestation before anything leaves your device, then encrypts the message so only that enclave can read it. Morse's servers relay ciphertext they can't read. The guarantee rests on the enclave hardware and attestation working as designed. Read how end-to-end encrypted AI chat works for each check.
• Anonymous, for the closed models you'd compare it with. GPT, Claude, and Gemini go through Morse's proxy, which removes your account, email, and IP address, so the provider answers without knowing it's you. The provider may keep the message for a limited time to check for abuse, under its own policy.

In every mode, your chat history is stored only in your browser, encrypted, and locked when you sign out. Morse doesn't train AI on your chats, sell your data, or show ads (privacy policy), and because Morse doesn't store chats, it usually has very little to give authorities. Clearing your browser deletes your history for good, so save anything you need to keep.

E2EE chats come with Pro, at $19 a month, with open-weight models such as GLM 5.3 Flash. Try a chat from the home page without an account, or start free and upgrade to Pro when you want to see the enclave checks for yourself.