Does Your Chatbot Spy on You?

ObscureIQ | 2025 Edition

Artificial intelligence is now part of daily life. Drafting documents. Summarizing emails. Writing code. Shaping decisions. Across every industry. But the more we use these systems, the more people ask the same questions:

• Are Large Language Models (LLMs) safe to use?
• Does Generative AI use my questions and answers to train their models?
• Can ChatGPT see my private data? Does it know who I am?
• Do AI companies keep a record of my conversations?
• How do chatbots know about things I asked them in the past?
• Which AI tool protects privacy best?

These aren’t just technical questions. They’re trust questions. Each prompt you enter reveals fragments of identity, context, or strategy. If that data is stored, reused, or linked to an account, it can become part of the model’s long memory. And part of someone else’s dataset. At ObscureIQ, we assess AI safety through a privacy lens. Our analysis focuses on two core dimensions:

• Where your data travels.
• Whether the system is built to forget.

This report ranks today’s leading generative AI platforms (from local open-source models to mainstream consumer bots) by how well they protect user data, limit retention, and minimize third-party exposure. It’s not about who answers best. It’s about who remembers least.

🔶 Self-Hosted or On-Device Models

Examples: GPT-4All, Mistral, LLaMA Privacy Posture: 🟩 Strongest (5/5) Running a model locally keeps everything under your control. No third-party logging. No training reuse. You decide what persists and what disappears. The trade-off is hardware and setup complexity, but the privacy return is total containment. *Note: User becomes responsible for endpoint security (OS patches, disk encryption).

🔶 Proton Lumo

Privacy Posture: 🟩 Strong (4.7/5) Operates under Swiss FDPA + GDPR jurisdiction and employs zero-access encryption, meaning Proton cannot read conversation content. It does not train on user prompts. Minimal metadata only: timestamp, device type, anonymized session ID. Operates under Swiss privacy law (FDPA + GDPR alignment). Independent audits remain limited, but Proton’s record in encrypted communications supports a high trust baseline. Zero-access encryption. Proton cannot read conversation content.

🔶 Brave Leo AI

Privacy Posture: 🟩 Strong (4.7/5) Built into the Brave browser with privacy-first architecture. Session data retained temporarily for continuity but not linked to user IDs or accounts. No data is used for training models. Operates under UK/EU GDPR jurisdiction with full transparency and user control via simple toggles. Leo processes requests through privacy-preserving infrastructure, ensuring queries remain anonymous and disconnected from browsing identity. Not linked to user IDs or accounts. Not used for training.

🔶 Mistral Chat (Cloud)

Privacy Posture: 🟩 Strong (4.4/5) GDPR-bound service with clear opt-out and deletion policies. Temporary storage ≈ 30 days for context continuity on the consumer “le Chat” interface; Zero Data Retention (ZDR) applies only to API and enterprise tiers. Transparent documentation and non-training defaults make Mistral the most privacy-aligned cloud option short of self-hosting.

🔶 Claude (Anthropic)

Privacy Posture: 🟨 Moderate (3.5/5) Enterprise / API data excluded from training. Consumer interface logs by default; retention can be disabled per chat. Even with logging off, Anthropic retains prompts ≈ 30 days for abuse monitoring (“Unbreakable Safety Loop”). Transparent but not private by default.

🔶 ChatGPT (OpenAI)

Privacy Posture: 🟨 Moderate (3.5/5) Users can disable training ( Settings → Data Controls → Improve the model for everyone = Off ) and chat history. Defaults still favor retention. Team / Enterprise / API tiers receive contractual zero-training guarantees, though API calls remain logged for security review. Privacy requires manual configuration and regular purging.

🔶 Perplexity AI

Privacy Posture: 🟨 Moderate (3.1/5) Perplexity functions as a hybrid search and chat engine. Logs by default; Private Mode disables local storage. Even in Private Mode, prompts transit third-party model providers (OpenAI / Anthropic), so data is only as private as the weakest partner. Enterprise contracts guarantee zero-training; consumer trust remains split across multiple jurisdictions.

🔶 Siri (Apple)

Privacy Posture: 🟨 Mixed (2.5/5) Audio recordings now require opt-in; text transcripts still processed on Apple servers. Retention periods undisclosed. Private Cloud Compute is beginning to process requests on-device but not universally deployed.

🔶 Gemini (Google)

Privacy Posture: 🟥 Weaker (2 / 5) Prompts linked to Google accounts and retained unless deleted. Even with “Activity Control” off, data persists ≈ 72 hours for operations and up to 3 years if flagged for human review. Disabling training breaks features like Docs / Gmail extensions. Privacy requires sacrificing functionality.

🔶 Copilot (Microsoft)

Privacy Posture: 🟥 Weaker (2/5) Tier-dependent privacy. Enterprise / Government versions offer zero-training and optional “Customer Lockbox” for data access control. Consumer versions retain telemetry and prompt data for product improvement across Windows and Office.

🔶 xAI / Grok (via X / Twitter)

Privacy Posture: 🟥 Weakest (1.3/5) Prompts are tied to X accounts and stored within the ad and social identity framework. No training opt-out or clear retention policy. Deletion removes visibility but not guaranteed server erasure.

🔶 Opaque or Unverified Providers

Privacy Posture: 🟥 Weakest (1/5) Lack of public policies means assume full retention and reuse. Examples include unregulated résumé screeners, entertainment chatbots, and “AI companions” with no published governance.

How We Scored

Privacy posture was determined using six equally weighted criteria:

• Prompt Retention: (25%) How long data persists after use.
• Training Opt-Out: (20%) Whether user data is used to train models by default.
• Jurisdiction: (15%) Which legal framework governs the data.
• Transparency: (15%) Availability and clarity of privacy documentation.
• User Control: (15%) Ability to disable retention, delete data, or operate anonymously.
• Default Behavior: (10%) Whether privacy requires configuration or exists by design.

This framework aligns with current academic and regulatory work examining privacy risks in large language models. Studies from Miranda et al. (2024) and Liu et al. (2024) describe how LLMs can memorize user data, reproduce personal information, and leak context through model inversion and membership inference attacks. Our scoring emphasizes not just policy transparency but data handling reality. Whether the architecture or business model itself is built to forget. Legal jurisdiction is treated as one input among technical and behavioral safeguards.

♦️ Key Points to Understand

• Local beats cloud. Containment equals control.
• Subscription beats advertising. Revenue model defines privacy model.
• Defaults matter. Opt-out ≠ protection.
• Voice AI ≠ private AI. Server processing still applies.
• Social integrations erase anonymity.

Recent policy analysis (King et al., 2025) found that most frontier AI providers retain user chats indefinitely by default and often bury training disclosures in secondary documents. Our findings align with that pattern: strong language in public-facing policies, weak guarantees in practice.

🔷 ObscureIQ Top Picks

The key question you should ask about the AI systems you use: What does it remember about you?

The broader literature is clear: privacy loss in generative AI is structural. Without explicit limits on retention and training reuse, every conversation becomes potential training data.

Choose systems engineered to forget.