If you type your deepest secrets into an AI chatbot, you are handing that information to a server in a data centre with no guarantee it will not be sold or shared.
Major models from OpenAI, Anthropic, and Google collect and store data by default. They use it to train systems, share it with partners, or hand it over to law enforcement via legal requests.
“You have this intelligent thing staring back at you, and you’re basically telling it, one question at a time, every possible thing there is to know about your life,” says Matt Green, a computer science professor at Johns Hopkins University. “You’re giving it this huge profile on you.”
Moxie Marlinspike, a cryptographer who built Signal, notes that text messaging was once the primary privacy risk. Now, that vulnerability has moved to AI interactions. Users share finances, health details, and relationship struggles with these tools.
“Those same things I was concerned about with messaging are happening in the AI space, but several orders of magnitude more significantly,” Marlinspike says. “People are integrating AI into their personal lives. They talk with it about their deepest insecurities, their finances, their health, their relationships.”
Earlier this year, Marlinspike launched Confer. It allows users to ask questions while preserving privacy. Cryptography prevents the service’s own server from logging conversations.
“Confer is designed to be a service where you can explore ideas without your own thoughts potentially conspiring against you someday,” he wrote in a blog post.
Confer is one of a new generation of services promising to fix the privacy invasion caused by standard chatbots. Some claim never to record conversations. Others anonymise data. A few, like Confer, use technology to restrict their own access to user secrets.
This competition has produced a growing crowd of tools. They often offer confusing assurances as users adopt an unavoidable technology without losing control of their data.
Zero Data Retention
Typing into ChatGPT, Claude, or Gemini starts with a baseline expectation of zero real privacy from anyone determined to access records. This includes the service owner, advertisers, contractors, law enforcement, or someone managing a civil lawsuit subpoena.
The main exception is a contract between a user or employer and an AI provider. Known as zero data retention, or ZDR, this provision requires immediate deletion of interaction records after processing.
OpenAI, Anthropic, and Google offer ZDR policies for enterprise versions. These are not available to average users. They generally require immediate deletion of records once processed.
Even ZDR policies have significant exceptions. Anthropic does not offer ZDR for its Mythos-class models like Fable 5.1. It cites potential for misuse like scamming, hacking, or autonomous misbehavior.
OpenAI announced last month that its ZDR implementations will analyse user activity prior to deletion. This happens on the customer’s systems, not OpenAI’s. The system, Private Safety Processing, flags abuse for the customer organisation.
It will alert OpenAI staff if abuse is detected in some cases, without revealing conversation content. Google warns it logs some Gemini prompts for abuse monitoring even with ZDR enabled. It excludes Google ID and IP addresses. However, sanitised data can sometimes pinpoint a person if the request includes identifiable information.
Policies, Promises, and Proxies
Enterprise-level contractual promises remain out of reach for most non-corporate users. Many consumer services ask users to trust weaker promises not to log conversations.
Proton offers Lumo, an AI chatbot described as private. This privacy relies on a promise not to log conversations, not the technical guarantees of end-to-end encryption found in Proton Mail or Proton Drive.
Users must trust Proton adheres to this policy. The company’s track record backs the promise. “A promise is not as good as a mathematical guarantee,” Yen told WIRED last month. “but a promise made by the right people is still actually quite substantial.”
Venice.ai and Duck.ai offer similar vows about keeping no logs. Both relay chat requests to other services like Claude or ChatGPT. They act as a proxy that limits what the underlying model collects.
Duck.ai lets users choose the third-party model. Venice.ai routes conversations to different services automatically. It sometimes answers queries with a model on its own infrastructure. Venice.ai touts trusted execution environment systems to prevent logging.
When WIRED asked Venice.ai staff for more questions about these features, the AI response bot referred to a nonworking email address.
Using an anonymity proxy offers some protection compared to direct use. Yet, Johns Hopkins’ Green points out that Duck.ai and Venice.ai promises become less meaningful. Chat messages can still be collected by the underlying AI model.
Even stripped of metadata, messages often contain identifiable information. Ask about local coffee shops, and you reveal where you live.
“All that stuff tied together is basically a fingerprint for you,” Green says.
Trusted Execution Environments and On-Device AI
Technological restrictions are better than privacy promises. They prevent a service from reading conversations. Cryptography provides this guarantee.
Unlike encrypted messaging, AI interactions cannot be truly end-to-end encrypted. Working models process unencrypted prompts. Some services offer the next best thing: a trusted execution environment, or TEE.
In this system, the server uses hardware, often Nvidia’s Confidential Computing. User queries process in isolated hardware. The server cryptographically proves the rest of the system has no access to that enclave.
Confer uses this Nvidia-based TEE setup. It adds an authentication system based on passkeys and open-source code. This offers perhaps the strongest consumer-level privacy protections currently available.
Meta uses a TEE for a private version of Meta AI in WhatsApp. Marlinspike helped develop this system. Tap the Ask button in the text field, then tap the speech bubble with a lock. You enter a new chat screen protected by a TEE.
Meta says this prevents it from keeping records. The Incognito system is not truly end-to-end encrypted like WhatsApp messaging. It approximates privacy promises for conversations with humans.
Meta’s newer AI agent, Muse, does not yet offer a TEE-based system. It promises to run in a segregated virtual machine. Meta says ad systems cannot access data. Users can opt out of data use for training.
Meta is releasing Muse Confidential VM later this year. It intends to cryptographically prevent Meta from accessing data in the virtual machine.
Apple offers Private Cloud Compute, or PCC. It enforces a promise that it cannot read conversations with Apple Intelligence. When a query processes on servers, the device checks the server runs unaltered PCC code. It keeps no logs and isolates data.
Users can ask Apple Intelligence to query ChatGPT or other third-party services. The same PCC protection does not apply. Apple checks with the user before sending the request. For most simple queries,
