The fastest test is airplane mode. Switch it on, ask the AI app a question, and if it still answers, the model is running on your phone and your words aren’t going anywhere. If it fails, your text is processed on someone else’s server and its privacy depends entirely on that company’s policies.
That test answers one question: where the AI runs. It doesn’t tell you what the app collects when you’re back online. The nine checks after it cover that, and the whole thing takes about ten minutes.
Check 1: does it work in airplane mode? #
- While you’re online, open the app and download whatever it needs: a model file, a language pack, an offline dictionary.
- Switch on airplane mode, then confirm Wi-Fi and Bluetooth are off too. Airplane mode alone can leave Wi-Fi on.
- Close the app completely and reopen it, so it can’t coast on a session that started online.
- Ask something new, attach a photo, or try the feature you actually care about.
- If it answers, the model is on your phone. If it errors, spins, or asks you to connect, the AI is in the cloud.
A hybrid app may answer easy questions and fail on hard ones, which tells you it sends some requests out. One limit to keep in mind: an app could store your data offline and upload it later, which is what the remaining checks are for.
Check 2: where does the model live? #
Local apps download a model file, usually 1 to 6 GB, and show you the size before it starts. If an app never downloads anything large and still answers instantly on a five-year-old phone, the work is happening on a server.
Check 3: does it need an account? #
An account ties every conversation to your email or phone number and usually means server-side storage. A fully local app doesn’t need one, because there’s nothing to sync. When an app that calls itself private insists on sign-in, that’s the thing to ask about.
Check 4: what does the store privacy label say? #
Check App Privacy on the App Store page or Data safety on Google Play. For an AI chat app the key categories are User Content (Apple) and Messages, Files and docs or Photos and videos (Google). If user content is collected and linked to you, your conversations reach the developer. AI app privacy labels explained walks through each heading and what it covers.
Both labels are written by the developer, so treat them as a declaration to verify rather than proof.
Check 5: is your data used for training? #
Search the privacy policy for “train,” “improve our models” and “machine learning,” then check the settings. Cloud providers often train on consumer chats unless you opt out: ChatGPT has “Improve the model for everyone” under Data Controls, Gemini ties it to Keep Activity, and Anthropic asks Claude users to choose. Policies here change every few months, so read the current setting rather than an old guide.
Check 6: how long is it kept? #
Look for “retain” or “retention.” Even with history off, providers usually keep chats for a window: Google says Gemini chats are held for up to 72 hours with Keep Activity off. Opting in to training generally extends retention, and Anthropic keeps opted-in Claude conversations for up to five years.
Check 7: does it hand your text to another AI company? #
Plenty of apps are thin wrappers around someone else’s model, so your text passes through two companies. Apple’s App Review Guidelines require apps to clearly disclose where personal data will be shared with third parties, “including with third-party AI,” and to get explicit permission first (guideline 5.1.2(i)). Watch for that prompt the first time you use an app.
Check 8: what else does the app contact? #
Analytics, crash reporting and ad networks all send data, even from apps whose AI runs locally.
On iPhone, turn on App Privacy Report under Settings, Privacy & Security. After a few days it lists every internet domain each app has contacted. A local AI app should show its model download host and, if it’s free, its ad network. A chat API domain appearing every time you send a message tells you the opposite.
On Android, there’s no built-in per-app network log on most phones. The Privacy dashboard covers camera, microphone and location. For traffic, an open-source firewall such as NetGuard can block an app from the internet entirely. If the AI still works with its network blocked, it’s local.
Check 9: are there ads, and are they personalized? #
Ad-supported apps contact ad networks. That doesn’t expose your conversations if the model runs on the phone, since the ad network never sees them, but device information does go to the ad company, and it means the app is not offline in the strict sense while you’re online. On iPhone, tapping “Ask App Not to Track” keeps the ads non-personalized. See do AI chatbots use your chats for ads? for how the big services differ.
Check 10: can you delete everything? #
A good app lets you delete one chat and all data. With a local app, uninstalling removes everything, because there was no second copy. With a cloud app, deleting your history may leave copies held for safety or legal reasons, so read the deletion section of the policy rather than trusting the button.
What do common privacy phrases actually mean? #
| Phrase | What it usually means | What it doesn’t mean |
|---|---|---|
| “On-device” or “local” | The AI model runs on your phone | That nothing else is sent; check analytics and ads |
| “End-to-end encrypted” | Only you and the recipient can read the message in transit | Doesn’t apply to chatting with a server-side AI, which has to read your text to answer |
| “We don’t sell your data” | It isn’t sold for money | It can still be shared with partners, used for training or used for ads |
| “Anonymized” | Identifiers are removed before analysis | Anonymized data can sometimes be re-identified when combined with other data |
| “Differential privacy” | Statistical noise is added so individuals can’t be singled out in aggregate stats | Your raw conversation isn’t collected at all |
| “Federated learning” | A model is improved from updates computed on devices, not raw data | Nothing leaves your device; model updates still do |
| “Private cloud” | Processing on company servers with extra protections | Your data stays on your phone |
| “Temporary chat” or “incognito” | Not saved to history or used for training | Not sent; it still reaches the server and is kept briefly |
Those techniques are real and useful. For you as a user, the plainest guarantee is still the first check: if the model runs on your phone and the app works offline, the conversation never has to leave.
Red flags and what they usually mean #
| What you notice | What it usually means |
|---|---|
| “100% private” with no explanation of where the model runs | Marketing, not architecture |
| You must sign in before you can chat | Your chats are stored server-side |
| Chat history syncs to your other devices | Copies live on the company’s servers |
| “May be processed on our servers” in the policy | Some or all requests leave the phone |
| Fails in airplane mode after setup | The AI runs in the cloud |
| “User Content” collected and linked to you | Your conversations reach the developer |
| No ads, no price and no stated business model | Worth asking how it pays for itself |
| One privacy policy covering a dozen unrelated apps | Nobody wrote it for this product |
Do you need a separate AI security app? #
Mostly no. Apps advertising “AI threat detection” are aimed largely at company-managed phones. On a personal phone the protections that matter are already there: keep the OS and apps updated, install only from the official stores, keep permissions tight (a chat app has no reason to want your contacts), and lock the phone properly. A local AI keeps chats off servers, but anyone who can open your phone can read them. Are offline AI apps safe? covers the device-side risks in detail.
Where Personal LLM stands on the checks #
We make Personal LLM, so here’s how it measures against the list. Once a model is downloaded it passes the airplane-mode test, because inference runs on the phone’s own chip using open models such as Qwen 3.5 4B, Gemma 4 E4B or Ministral 3 3B. There’s no account, no cloud sync, no analytics on conversations and no server of ours for anything to be stored on. Two things use the network: the one-time model download straight from Hugging Face, and Google AdMob ads in the free version, which is why the app isn’t “100% private” while you’re online, even though the ad network never sees your chats. Declining App Tracking Transparency on iOS keeps those ads non-personalized, and a one-time purchase removes them. You can delete any chat, export a backup as a plain JSON file, or uninstall and take everything with you.
For what local processing does and doesn’t cover, see is on-device AI private?.
Frequently asked questions #
How do I know if an AI app sends my data to a server? #
Test it in airplane mode after downloading whatever it needs. If it stops working, your requests go to a server. On iPhone, App Privacy Report also shows which domains the app has contacted over the last seven days.
Does airplane mode prove an app is private? #
It proves the AI runs on your phone, not that the app never uploads anything. An app could store data and send it later. Pair the test with the store privacy label, the App Privacy Report and the policy.
Are “on-device AI” apps always private? #
The model’s processing is, but the app around it may still send analytics, crash reports or ad requests, and some hybrid apps fall back to a cloud model on hard questions. Check the label and the airplane-mode behavior rather than the marketing copy.
What is the App Privacy Report on iPhone? #
A log under Settings, Privacy & Security that records which apps used sensitive permissions and which internet domains each app contacted over the last seven days. It’s the simplest way to catch an app talking to servers you didn’t expect.
Can I trust App Store privacy labels? #
They’re a useful starting point. Developers fill them in themselves and the stores don’t audit every one, so compare the label against the privacy policy and the app’s actual behavior.