What data do AI chatbots collect? We read 14 apps' privacy policies

The Morse teamPublished October 31, 202612 min read

Most AI chatbots collect data well beyond your messages. As of October 2026, the privacy policies of ChatGPT, Claude, Gemini, Grok, Meta AI, Copilot, and Perplexity all list your IP address and the rough location it reveals, identifiers for your device, and logs of how you use the app, and most add payment details, cookies, and information they receive about you from other companies.

We read the privacy policies of 14 AI chat apps on October 31, 2026, along with each one's privacy label on Apple's App Store, and recorded what each says it collects beyond the chat itself. The top results for this question count App Store labels. The policies show what a label has no box for: Microsoft buys data from brokers, Meta takes partner data whether or not you're logged in, and OpenAI may hear from advertisers about what you buy. A few collect much less: Mistral, Proton's Lumo, and Duck.ai describe very little, and Google coarsens the location it stores with your Gemini activity.

What data do AI chatbots collect besides your chats?

Device details, location, account and payment data, and often data from third parties. The table covers consumer apps, not business or API plans. Every cell links to the app's own policy or its own App Store listing, read October 31, 2026. Who sees your data once it's collected (trackers, training, retention) is a different question, covered in do AI chatbots share your data with trackers and are AI chats private.

The policies carry these dates: xAI's was last updated October 27, 2026, Perplexity's October 23, Gemini's privacy hub October 26, Duck.ai's October 1, Anthropic's took effect September 10, Microsoft's is dated September 2026, Pi's August 11, Meta's took effect July 23, Character.AI's July 1, and DeepSeek's was last updated February 10, 2026. OpenAI's page names May 18, 2026 as its previous version. Mistral's and Qwen's pages showed us no date.

Which AI chatbots collect your precise location?

Seven of the 14 describe taking precise location from your device, usually once you've allowed it: Gemini, Meta AI, Copilot, ChatGPT, Claude, Grok, and Pi. Google's Gemini hub is the most direct. It says "Location data is always collected if you use Gemini Apps," and that Gemini "may receive your precise location from another Google service, like Google Maps, to fulfill your request even if the precise location setting in the Google app is off" (Google).

Google does limit what it keeps. Location stored with your Gemini Apps Activity is coarsened to an area "larger than 3 sq kilometers" with "at least 1000 users," and precise location from your device isn't stored there at all (Google). Gemini's other settings are in is Gemini private.

Meta's list goes furthest. Its device signals include "GPS, Bluetooth signals, nearby Wi-Fi access points, beacons and cell towers" (Meta). Microsoft counts location as precise when it comes from "GPS, cell tower, or Wi-Fi hotspot location" (Microsoft).

At the other end, DeepSeek says it won't get precise geolocation "without your explicit consent," Mistral lets you switch off its IP-based location, and Proton says Lumo's apps "do not access or track any location-based information" (DeepSeek, Mistral, Proton).

Do AI chatbots get data about you from other companies?

Yes, several say so. Microsoft's privacy statement, which covers Copilot, lists "Data brokers from which we purchase demographic data and contact information to supplement the data we collect" (Microsoft). Of the 14 policies, it's the only one to name data brokers.

Meta's policy covers AI at Meta alongside Facebook and Instagram. It says partners send it "Websites you visit and cookie data," "Purchases and transactions you make off of our Products," and "Your demographics, like your education level," and adds: "We receive this information whether or not you're logged in or have an account on our Products" (Meta). Our page on whether Meta AI is private covers what Meta does with the chats themselves.

OpenAI says it receives "information from advertisers and other data partners," and gives an example: "we could receive information about purchases you make from these advertisers" (OpenAI). Character.AI takes in how you interacted with its ads on YouTube, TikTok, or Reddit, with demographic and location data (Character.AI). Qwen names "advertising and analytics partners" (Qwen).

Signing in with another account brings its own data along. If you use X to sign in to Grok, xAI says you may direct X to share your public profile, your X Premium status, and your "Grok on X conversation history" (xAI). Pi, with permission, can reach "information in your contacts, emails, calendar, or documents" on the platform you sign in with (Inflection).

Do AI chatbots read your contacts?

Some can, if you let them. ChatGPT's contact sync uploads "information from your device address books" and tells you when contacts join later (OpenAI). Gemini's mobile apps can collect "call and message logs, contacts (to help you keep in touch)" (Google). Copilot's App Store label lists Contacts as data linked to you (App Store).

Do AI chatbots record your keystrokes?

None of the 14 policies we read mentions keystroke patterns, and DeepSeek's dropped its "keystroke patterns or rhythms" line in the version dated February 14, 2025, as we cover in is DeepSeek safe.

Three policies come close in other ways. Microsoft collects "text, inking, and typing data" from its products (Microsoft). Meta records "whether our app is in the foreground or if your mouse is moving (which can help tell humans from bots)" (Meta). Perplexity says its cookies or pixels may learn "which links you click or what you type as a prompt" (Perplexity).

Do AI chatbots build a profile of you?

Several say they draw inferences from what they collect. Pi may "make inferences about your emotional state, tone, sentiments, or other characteristics" from your inputs, and lets you turn off using voice to infer emotions in your account settings (Inflection). Character.AI generates "inferences about use of the Services, such as your preferences and interests" (Character.AI). Microsoft keeps interests "that we infer from your activity, such as your activity on sites that use our technology for ads purposes," and says Copilot ads may relate to "your Copilot conversations (including files you share)" (Microsoft). OpenAI collects ad history and interests for Free and Go users (OpenAI).

Do App Store privacy labels tell the whole story?

No. The most-cited count is Surfshark's, published September 28, 2026 from labels pulled September 22: Meta AI declared 33 of the 35 data types Apple lists, Pi 3, and Surfshark found precise location only in Gemini, Meta AI, Meta's Muse, and Perplexity (Surfshark). On October 31, Grok's label listed Precise Location too (App Store).

Labels and policies don't always match. Perplexity's label lists Precise Location, linked to your identity, for product personalization (App Store), while its privacy notice describes only "general location from the IP address" (Perplexity). Apple notes on every label that it "has not been verified by Apple." A label also counts only what the app gathers, so the brokers, advertisers, and sign-in partners in the section above don't appear on it.

How do you limit what an AI chatbot collects?

Turn off what you can, and give each app less to start with.

• Say no to location. ChatGPT, Grok, Pi, and DeepSeek say precise location depends on your choice or consent. Gemini can get it from Google Maps, so check Maps' permission too.
• Don't connect contacts or other accounts. Contact sync, connected apps, and permission to read email each hand the app more about you.
• Sign up with an email address rather than X, Google, or Facebook, so the app gets only what you type in.
• Use the switches the policies name. Mistral lets you stop IP-based location in your user preferences. Pi lets you turn off voice emotion inference in its account settings. Character.AI lists a right to opt out of "targeted advertising."
• Hide your IP address from the service with a relay. A relay can keep who you are apart from what you ask, which is the idea behind Oblivious HTTP.

If an app asks for your phone number, which AI chatbots need a phone number lists the ones that insist.

How Morse keeps what it knows about you small

Most apps above build their picture of you around an account on their own servers, then add what your device, their partners, and their advertisers report. A Morse account holds sign-in details, your plan, your balance, and a usage ledger with no content. Your chat history is stored in your browser, encrypted, not on Morse's servers, and our servers don't keep messages or log what you write. You sign in with a code sent to your email, or with Google.

Morse runs no advertising trackers or third-party analytics, shows no ads, doesn't sell your data, and doesn't train AI on your content. You choose a privacy mode for each chat:

• Anonymous, to use GPT, Claude, and Gemini without the provider getting your IP address or your account. Our proxy removes your account, email, and IP address and sends the message under Morse's own account, so the provider sees it without knowing it's you. It may keep the message for a limited time to check for abuse, under its own policy, so leave out your street, your employer, and anything else that places you.
• Private, for open-weight models and Grok on hosts that agreed to keep nothing. It strips the same details as Anonymous, and Morse has zero data retention agreements with its inference, search, and other providers. Where a provider confirms zero retention on each reply, Morse checks it and refuses a reply that doesn't. New chats start here.
• E2EE, for anything no one else should read. Your browser checks the enclave's hardware attestation, then encrypts the message so only that enclave can read it, and our servers relay ciphertext they can't read. The enclaves are run by third-party providers, not by Morse, and the guarantee rests on the enclave hardware and attestation working as designed.

In every mode, history stays in your browser, locked when you sign out and opened with two keys, one of which never leaves your device. Clearing your browser deletes your chats for good, and Morse can't recover them, so keep a copy of anything you need.

Try a chat from the Morse home page without an account, or start free with no card needed. End-to-end encrypted chats come with Pro, at $19 a month.