How to Use AI With Your Privacy Intact

How to Use AI With Your Privacy Intact starts with a hard truth. When you type into ChatGPT, Claude, or Gemini, you should assume you have approximately zero real privacy from anyone determined to access those records and with a legal path to get them.

That list is longer than most people think. It includes the company running the service, advertisers and partner firms, contractors hired to fine-tune the systems, law enforcement agencies, and even a plaintiff in a civil lawsuit who manages to subpoena your chat history.

Matt Green, a privacy and security researcher at Johns Hopkins University, puts the problem in blunt terms. The intelligent thing staring back at you is collecting, one question at a time, every possible detail about your life. You are handing it a huge profile of yourself.

Cryptographer Moxie Marlinspike built Signal in 2014. Why? Because unprotected texting had become the most sensitive data people carried on their phones. He sees the same vulnerability now, shifted to AI, and worse. People talk to these tools about their deepest insecurities, their finances, their health, their relationships. And the concerns he had about messaging are playing out in AI, he says, several orders of magnitude more significantly, which means the thing he warned us about with texting is happening again, only this time it's bigger, and we've handed these tools everything.

The One Contract That Actually Helps

The strongest exception to the default surveillance model is a contract between you, or more likely your employer, and an AI provider that legally forbids retaining your records. The industry calls it zero data retention, or ZDR.

OpenAI, Anthropic, and Google all offer ZDR for enterprise versions. When enabled, the policy generally requires immediate deletion of user interactions once they are processed. Even here, the fine print matters. Anthropic does not extend ZDR to its most sophisticated models, citing risks like scamming, hacking, and autonomous misbehavior, such as AI agents independently attacking targets on behalf of unwitting users.

OpenAI made a change. Its ZDR setup will now analyze user activity before deletion, running that check on the customer's systems rather than its own, which means the abuse review happens inside the client's environment instead of OpenAI's. If it detects abuse, it flags the customer organization. And in some cases, it alerts OpenAI staff without revealing conversation content, so nobody at OpenAI reads the actual messages. Google warns that it logs some Gemini prompts for abuse monitoring even with ZDR on, stripped of user ID and IP address, though sanitized data can still point to a person when the request itself contains identifiable details. They're clear about that limit. We've got two companies, two approaches, and the same underlying tension between catching abuse and protecting the people whose data is being scanned.

And all of this sits out of reach for ordinary users. ZDR is a paid, enterprise and developer tier feature.

Promises, Proxies, and the Fingerprint Problem

Most consumer AI services ask users to settle for less. It's just a policy promise not to log conversations. Proton's chatbot Lumo markets itself as AI where every conversation is private, but that privacy rests on Proton's word rather than the end-to-end encryption used in Proton Mail and Proton Drive, which is a big difference when you think about what actually protects your data. The company's long track record backs the promise. And its representative has argued that a promise made by the right people is still substantial, even if it isn't a mathematical guarantee, because they're saying trust matters here.

Venice.ai and Duck.ai take a different route. Both relay your requests to underlying models like Claude or ChatGPT, acting as a proxy that limits what the base model can collect. Duck.ai lets you choose the third-party model. Venice.ai routes automatically, sometimes answering through its own hosted infrastructure, and its other privacy claims include trusted execution environments. When a reporter tried to reach Venice.ai staff with follow-up questions, its AI response bot only repeated a nonworking email address.

Proxy routing helps. But not as much as it looks. Your messages can still be collected by the underlying model, and stripping metadata does not strip meaning, so the content itself remains exposed. Ask about coffee shops in your neighborhood. You've revealed where you live. Green's point is that all those details tied together, the timing, the topic, the phrasing, the places you mention, form a fingerprint, and it's one you can't easily erase, because they're bound up with what you actually said.

"All that stuff tied together is basically a fingerprint for you," Green says.

When the Server Cannot Read Your Chats

Technology beats policy. That is the logic behind trusted execution environments, or TEEs. AI prompts cannot yet be end-to-end encrypted the way a Signal message can, because working models need to process unencrypted input. A TEE gets close to the next best thing.

In a TEE setup, the server runs the model on isolated hardware, most often Nvidia's Confidential Computing, and can cryptographically prove that the rest of the system has no access to that sealed enclave. Confer, the chatbot Marlinspike launched this year, combines an Nvidia-based TEE with passkey authentication and open-source code anyone can audit. It may be the strongest consumer-level privacy protection currently available in an AI chatbot.

Meta uses a TEE for a private mode inside WhatsApp's Meta AI. Tap the Ask button. Then tap the speech bubble with a lock. You enter a chat that Meta says leaves no record. It's not end-to-end encrypted like the rest of WhatsApp, but it approximates that promise inside an AI conversation. Meta's newer agent, Muse, runs only in a segregated cloud virtual machine for now, with an opt-out for training data and a Confidential VM version planned. Apple's Private Cloud Compute enforces a similar pledge: your device cryptographically verifies the server is running unaltered Apple code designed to keep no logs and block remote access. But queries routed to third-party services don't get that protection, and Apple checks with you first.

Local Models: Private but Dumb

Ollama, LMStudio, and LocalAI run entirely on your own machine. Nothing leaves it. That's privacy no cloud service can match. And because everything stays right there on the hardware you already own, you don't have to hand your data to anyone else, which is a level of privacy that cloud services, no matter how they market themselves, simply can't offer you.

• No logs, no subpoenas, no server-side retention by design
• Frequent stumbles and far more hallucination than cloud models
• Green's verdict: you can run them on any laptop, and they are dumb as rocks

What Privacy Costs

Confer charges $34.99 a month for its cheapest tier after roughly 20 to 25 free daily queries. ChatGPT and Claude charge $20 for their cheapest paid plans. Marlinspike argues the premium reflects the real cost of running a model without subsidies from data collection or advertising, while other paid providers offset costs by monetizing user data in one way or another.

Green raises the harder question. Running frontier models consumes serious energy and hardware, and it is not yet clear whether companies that refuse to monetize user data can sustain themselves, or whether some will eventually abandon or undermine their promises. The technology to use AI with your privacy intact exists. It just may cost more than you expect.

If you want real privacy, Green says, you might have to pay for it.

Frequently Asked Questions

Who might be able to access the records of your chats with AI tools like ChatGPT, Claude, or Gemini?

According to the article, that list includes the company running the service, advertisers and partner firms, contractors hired to fine-tune the systems, law enforcement agencies, and even a plaintiff in a civil lawsuit who manages to subpoena your chat history. The article states you should assume you have approximately zero real privacy from anyone determined to access those records and with a legal path to get them.

What is zero data retention, and why isn't it available to ordinary users?

Zero data retention, or ZDR, is a contract between you or more likely your employer and an AI provider that legally forbids retaining your records, and when enabled the policy generally requires immediate deletion of user interactions once they are processed. OpenAI, Anthropic, and Google all offer ZDR for enterprise versions, but the article notes it is a paid, enterprise and developer tier feature that sits out of reach for ordinary users.

How do trusted execution environments protect AI chats when prompts cannot be end-to-end encrypted?

The article explains that AI prompts cannot yet be end-to-end encrypted the way a Signal message can, because working models need to process unencrypted input. In a TEE setup, the server runs the model on isolated hardware, most often Nvidia's Confidential Computing, and can cryptographically prove that the rest of the system has no access to that sealed enclave.

Why does the article say that proxy services like Venice.ai and Duck.ai only help so much?

Proxy routing helps, but the article says not as much as it looks, because your messages can still be collected by the underlying model and stripping metadata does not strip meaning, so the content itself remains exposed. The article gives the example that asking about coffee shops in your neighborhood reveals where you live, and Matt Green says all those details tied together form a fingerprint you can't easily erase.

What are the tradeoffs of running AI models locally on your own machine?

The article says Ollama, LMStudio, and LocalAI run entirely on your own machine, so nothing leaves it, giving you privacy no cloud service can match, with no logs, no subpoenas, and no server-side retention by design. However, Green's verdict is that you can run them on any laptop, and they are dumb as rocks, with frequent stumbles and far more hallucination than cloud models.