Is Dia browser safe? What its AI sends, keeps, and trains on

The Morse teamPublished October 28, 202610 min read

Yes, as of October 28, 2026, Dia is a safe browser to use, but its AI keeps some of your content by default until you switch off "Share content data to help improve Dia." Dia is a Chromium browser with weekly security updates. Its AI sends your question and the page you're on through The Browser Company's servers to OpenAI, Anthropic, or Google, which Dia says are contractually barred from keeping it or training on it. With that setting on, Dia itself keeps some of your content, unlinked from your account, for 30 days, and its terms let it use what you submit "to train our models."

We read Dia's privacy policy (effective April 9, 2026), its terms of use (effective August 17, 2026), its security page and FAQ, its security bulletins, its release notes back to September 2025, and Atlassian's pages on the acquisition and on its AI data changes, all on October 28, 2026. The Browser Company deserves credit for naming its model providers, listing its CVEs, and publishing a long account of a prompt injection flaw it found in its own tool and pulled before launch.

Dia browser key facts, October 2026

What does Dia send to AI companies?

Your question and whatever context the request needs. Dia's security FAQ says "the data needed to fulfill your request (such as your question and relevant context) is sent through our servers to trusted AI partners." It names them as "GPT (OpenAI), Claude (Anthropic, Vertex, AWS), Gemini (Vertex)," so a Claude request can run on Anthropic's own service, on Google Cloud, or on Amazon's. Another answer on the same page adds Azure.

Dia's page for businesses says Dia "has zero data retention (ZDR) agreements with all partners." Our explainer on zero data retention covers what that promise usually leaves out, such as abuse checks.

Some data leaves without a question. Dia's FAQ says "some features, like the Morning Brief, do this on their own to prepare information for you." The Morning Brief reads the tools you connect, which since Dia 1.48.0 on September 10, 2026 include Outlook, SharePoint, and Teams. Dia says it makes "a best-effort attempt to keep sensitive sites out of passive features," and adds, "That's not a guarantee, and it doesn't apply when you deliberately include a site in a request."

Incognito keeps Dia's AI out. Dia's install page says "Incognito mode doesn't include Dia's AI features" and that browsing there "is never logged."

Does Dia train on your data?

The AI companies don't, and Dia does unless you opt out. Dia's security FAQ says "by default, we use some content data to improve Dia," and that this data "isn't tied to your account, is retained for 30 days, and then deleted." Dia's privacy policy defines content data as "the pages you visit using Dia and queries submitted to and responses created by the Dia Assistant."

Dia trains models of its own, too. The FAQ says "we also train small models that run on your device, for tasks like choosing which AI provider to handle a request," and that some content data may go into them. The terms of use give Dia a "perpetual, irrevocable" license to what you submit, to "develop and improve Dia, including to train our models," with an opt-out "in the privacy section of your account settings."

To turn content sharing off, open Settings, then Privacy, and switch off Share content data to help improve Dia. Dia says you can stop the on-device training in Settings too, but its FAQ doesn't name that switch. Companies can turn content sharing off for everyone.

What happened to Dia's Memory?

Dia retired it. The release notes for Dia 1.50.0, dated September 24, 2026, say: "We're phasing out Dia's memory feature and deleting existing memory data, since newer models no longer need it to understand your context." Dia now pulls context "from richer on-demand tools instead," and the same release lets Chat search your browsing history "by date, page title, or URL/domain" and read past chats.

Memory worked from summaries of your browsing, which Dia's FAQ describes as "created on our servers and stored locally on your device." In September 2025, Dia said Memory skipped "sensitive sites (like banks) and all incognito tabs."

Dia's own pages haven't caught up. Its security FAQ, read on October 28, 2026, still says Memory "can be disabled in your Dia Settings at any time." The settings drawing on Dia's home page still shows Memory switched On and "Share content data" switched Off, the reverse of the sharing default that Dia's FAQ and install page describe.

Is Dia vulnerable to prompt injection?

Yes, and Dia says so. Its security FAQ says "all AI chat systems face this risk" and that Dia's stance is "to assume prompt injections may occur." Its controls include these:

• Dia "won't automatically open or follow LLM-generated URLs," a common way to smuggle data out.
• A chat "starts with no access to other tabs or ability to take write actions" until you grant it.
• Forms and emails are shown to you in full before Dia fills or sends anything, and in agent mode, password fields are "invisible to the agentic system."

Dia also says an injection can still "nudge content toward misinformation" or "trigger unintended assistant actions, like searches or lookups you didn't ask for." Read what the assistant drafts before you approve it.

Dia's security bulletin of February 12, 2026 tells how it learned this. Its team found that a planted instruction could make the fetch_web_content tool put private data into a web address and send it out. Detection kept failing, and the team bypassed every AI model it tried as a guard, so it removed the tool before the June 2025 public beta. The tool came back "a couple of months later," built to reject any web address that doesn't trace back to something you opened or shared.

Our guide to prompt injection explains the attack itself. OpenAI made a similar admission about Atlas in a December 2025 post, before retiring the browser (our Atlas guide).

Is Dia safe for banking, health, or work accounts?

Dia's answer is "It depends on whose data is involved." For your own bank or health portal, its security FAQ says "it's your call." When you include such a page in a request, Dia sends "your prompt and the relevant page content to a third-party AI model."

For other people's data, Dia draws a line. It says Dia "should not be used for work that involves PHI or other data you're obligated to protect under a law like HIPAA," that it "is not HIPAA-compliant," and that it offers no Business Associate Agreement. Organizations can switch off AI features on chosen sites through Dia's device management controls. This isn't legal advice. Our guide to private AI for health questions covers what HIPAA reaches, and what your employer can see covers work laptops.

Did Atlassian's ownership change Dia's privacy?

Not on paper so far. Atlassian announced its agreement to buy The Browser Company on September 4, 2025, promising that "security, compliance, and admin controls will be baked into every aspect of Dia." Dia's security FAQ says Dia now uses Atlassian for sign-in and identity and "continues to operate under its own privacy policy." If your employer manages your email, your account follows that organization's Atlassian settings.

Atlassian's 2026 change to AI training on customer data doesn't name Dia. Atlassian's data contribution page says the change "went into effect on August 17, 2026" and applies first to Jira, Confluence, Jira Service Management, and platform apps such as Rovo. Atlassian says it "will not use metadata or in-app data from apps where no data contribution settings are available." Neither that page nor its FAQ mentions Dia.

Dia's current terms took effect the same day. Their license to "train our models" was already in the August 29, 2025 version, which Dia still publishes beside the current one and which predates Atlassian's announcement. Dia's privacy policy also says personal data "may be transferred to a third party" in a merger or acquisition.

Dia's security and privacy timeline

Built from Dia's release notes, security bulletins, and terms, and Atlassian's pages, all read on October 28, 2026.

How to get AI help with a page without sharing your browsing

Each issue above comes from where Dia's assistant sits. It runs inside the browser that holds your tabs, your history, and your logged-in accounts, so features like the Morning Brief choose what to send, and Dia's 30-day copy for improving the product stays on until you find the setting. Morse sits outside your browsing. It's a chat app, and a Morse chat holds what you type, paste, or attach, so the part of a page you ask about is the part you chose.

Morse doesn't train AI on your content, sell your data, or show ads, which leaves no 30-day copy to opt out of. Dia deserves credit for keeping chats encrypted on your device, and Morse does the same: your history is stored only in your browser, encrypted, and Morse's servers don't keep your messages or log what you write. Attached files go with the message and are never stored by Morse. Clearing your browser or deleting your account erases the chats for good, because Morse can't recover them, so save anything you'll want later.

Pick a mode by what the page holds:

• Anonymous, for the GPT, Claude, and Gemini answers you'd get from Dia, without your name on the request. In Dia, a Claude request may run through Anthropic, Google's Vertex, or AWS after passing Dia's servers. In Morse, our proxy takes off your account, email, and IP address and sends the request under Morse's account. The provider still sees what you pasted, without knowing it's you, and may hold it for a limited time for abuse checks under its own policy, so take names out of a page before you paste it.
• Private, the default, for an ordinary article or doc that no host should keep. It runs open-weight models such as DeepSeek, Kimi, and GLM, plus Grok. Morse has zero data retention agreements with its inference, search, and other providers, and it strips who you are, as in Anonymous.
• E2EE, for the bank statement or health portal page that Dia leaves to "your call." Before the text leaves your device, your browser checks the enclave's hardware attestation for itself and seals the message so only that enclave can decrypt it, and Morse's servers carry only ciphertext they can't open. That protection depends on the enclave hardware and attestation working as designed. E2EE runs open-weight models with no web search, and it comes with Pro at $19 a month.

If you keep Dia for browsing:

• Training: in Dia, open Settings, then Privacy, and switch off Share content data to help improve Dia. Morse has no such setting, because it doesn't train on your chats.
• Sensitive pages: in Dia, use incognito, where the AI features are off. In Morse, paste just the passage you need into an E2EE chat.

The details are in our privacy policy. Paste the next page you'd have asked Dia about into a free Morse chat, with no card needed.