Four different promises get sold under one word. A chatbot that is not trained on your input may still keep it for years. One that discards it may still have shown it to a human first. The strongest version, that the provider is technically unable to read the conversation, is claimed by almost nobody. Sorting alternatives by which of the four they actually make produces a shorter list than most roundups, as coverage of Proton’s Lumo, of the major assistants’ opt-out settings and of the assistants that don’t train on conversations each showed in part.
Four Claims, One Word
The four claims: (a) not used to train models, (b) not retained server-side, (c) encrypted in transit, (d) the provider is architecturally unable to read them. Claim (c) is table stakes. Claims (a) and (b) are independent, and vendors routinely answer a retention question with a training answer. Claim (d) needs confidential computing or no server.
| Service | Trained on | Retained | Cannot read |
|---|---|---|---|
| ChatGPT | Opt-out | 30 days after deletion | Not claimed |
| Claude | Opt-out | 30 days, or 5 years if opted in | Not claimed |
| Gemini | Default yes, opt-out via Keep Activity | Reviewed chats up to 3 years | Not claimed |
| Duck.ai | No, by contract | Provider deletion at most 30 days | Sync and Backup only |
| Brave Leo | No | Discarded after the chat | Not claimed |
| Proton Lumo | No | Erased after the response | Stored history only |
| Venice AI | No, by contract | Not stored for inference | Asserted, not verified |
| Mistral Vibe | Opt-out (Enterprise opted out by default; Teams/individual opt-out is manual) | Indefinite, until you delete | Not claimed |
| Ollama, LM Studio, llama.cpp | No server | No server | No server |
Every row is sourced below.
The Default Assistants Are Opt-Out
Anthropic’s policy, effective July 8, 2026: “We may use your Inputs and Outputs to train and improve Anthropic AI models, unless you opt out through your account settings.” (Anthropic). The announcement introducing it called the same control “the choice to allow their data to be used to improve Claude” and told users “you’re always in control of this setting” (Anthropic). One reads opt-in; the operative text is opt-out. Allowing it also extends retention to five years, against 30 days if you decline (Anthropic Help Center).
Google is blunter. Gemini chats feed service development including model training, a subset goes to human reviewers, and that subset outlives deletion: “Chats reviewed by human reviewers (and related data like your language, device type, location info, or feedback) are not deleted when you delete your activity. Instead, they are retained for up to three years.” (Google).
OpenAI does not train on business-product data by default; for individual services, training may occur unless the user opts out, and the opt-out is not retroactive (OpenAI Help Center). Its statement on the New York Times data demands says deleted conversations and Temporary Chats go within 30 days, and that “we are no longer required to indefinitely retain new user data going forward”. The same statement says it still securely stores a bounded set of historical 2025 consumer data that the plaintiffs are seeking (OpenAI).
The Privacy-Positioned Hosted Tier
Proton is the most careful vendor here. Lumo keeps no logs of what you ask or what it replies, erases data once a response is generated, and syncs saved chats with zero-access encryption (Proton). Its security-model post, dated August 4, 2025 and over a year old, says “no system at Proton can ever read a Lumo conversational history”, then draws the boundary itself: “The user’s cleartext message never leaves the server, and the request is not logged or retained by the LLM server after completing that request.” (Proton). Zero-access encryption covers stored history, not inference, which is not confidential computing. No independent audit of Lumo was found.
Venice AI makes the one clear claim of the fourth kind. Its policy says it may record that you created a chat but will not access or store prompt and output content, while still collecting metadata like time zone, browser type and IP address (Venice AI). Its docs set out four per-model privacy modes rather than one toggle: Anonymous, Private (“Zero data retention, contract-enforced”), TEE (“Hardware-isolated inference” with remote attestation) and E2EE, where “Your client encrypts the prompt before sending it. Venice relays ciphertext, and only the verified TEE decrypts it.” Only the TEE and E2EE modes make the fourth kind of claim, both are text-only, and you reach them by selecting one of those models rather than flipping a setting (Venice AI Docs). Asserted by the vendor; no independent audit was found.
Duck.ai’s guarantee is contractual. Recent chats are saved locally on your device unless you opt out, and DuckDuckGo strips personal metadata before calling providers on your behalf. Its agreements with model providers bar training on prompts and outputs and require “deleting all information received once it is no longer necessary to provide Outputs (at most within 30 days, with limited exceptions for safety and legal compliance)”. Zero Data Retention is not a blanket description but one of several per-model tiers, “described on a per-chat basis in the privacy dialogue for that chat session”. Optional Sync and Backup stores chats on DuckDuckGo servers under a key held only on your devices, so “DuckDuckGo cannot decrypt your chats” (DuckDuckGo). No published audit of those contracts was found. Brave’s Leo, documented inside the general browser policy, does not train on conversations and does not retain them: “We don’t store or retain prompts, responses, context, or personal data on our servers. We may cache large prompts to improve performance but these are deleted within minutes.” Conversation history is encrypted and stored locally on the device (Brave). An earlier version of this page said Anthropic-model queries were held by Anthropic for 30 days; the policy makes no such statement and that claim has been removed.
Mistral’s assistant, the product formerly called Le Chat and now named Vibe throughout its policy, is the retention outlier: “we keep your Input and Output until you delete your account or until you delete the conversation from Vibe.” (Mistral AI). Indefinite, not a fixed window, and materially less favourable than the 30-day defaults above. Training use has an in-account objection control per the help center article dated 2026-09-03. Crucially the default state differs by tier: Vibe (Enterprise) customers are opted out of training by default with the opt-in toggle managed at the admin level, while Vibe (Teams) administrators can disable data training for the whole organisation, and individual Vibe users are not opted out by default and have to flip the toggle themselves (Mistral Help Center). An earlier version of this page said paid tiers were not used for training by default; the current help center article restricts that to Vibe Enterprise.
The Local Tier and Its Wrinkles
Running the model yourself is the only configuration where the fourth claim is structural, not promised. Ollama says it does not collect, store, transmit or access content processed locally, while separately collecting account details and device and usage information including your IP address (Ollama). LM Studio says “the application does not include telemetry or user-specific tracking” and that locally run chats never leave your system, though update checks send app and device details and an IP address (LM Studio).
Two wrinkles. Open WebUI has no formal privacy policy; a maintainer wrote in the project’s own discussion that “we don’t collect any data, you don’t have to opt out of anything” (Open WebUI), yet its issue tracker records a bundled ChromaDB dependency attempting outbound telemetry, with a reporter writing that “OpenWebUI’s chromadb should not send telemetry, or attempt to send telemetry”. The maintainer closed it the next day, pointing at the shipped Dockerfile, which sets ANONYMIZED_TELEMETRY=false and SCARF_NO_ANALYTICS=true by default (Open WebUI issue tracker). And llama.cpp has no privacy policy at all, because there is no company behind it; its README does not mention telemetry, analytics, phone-home or auto-update (llama.cpp). That is silence rather than a denial.
What This Means
Work out which claim you need, then check only that one. Fear of a future model reciting your text needs only (a), which the opt-out controls at OpenAI, Anthropic and Mistral largely deliver once actually flipped, though with carve-outs the vendors state themselves. Anthropic’s is explicit: “Even if you opt-out, we will use Inputs and Outputs for model improvement when: (i) your conversations are flagged for safety review… or (ii) you’ve explicitly reported the materials to us” (Anthropic). Fear of discovery, subpoena or breach makes training policy irrelevant and retention the whole question. Fear of the provider itself needs (d), which only Venice’s TEE and E2EE models and the local tier offer here. Two asymmetries follow: an opt-out that also governs retention means the untouched default multiplies how long data lives (Anthropic Help Center), and human review sits outside the delete button at Google (Google).
The Bottom Line
For the most externally enforceable footing, Duck.ai’s provider contracts are the strongest arrangement here, and no audit of them was found. Lumo is best described as encrypted storage plus a no-logs claim, not a provider that cannot see your prompt. For provider-cannot-read from a hosted service, Venice’s TEE and E2EE models are the only clear claim, and it is unverified. And for anything that must not leave your control, only the local tier gets its guarantee from architecture rather than a document that can be rewritten next quarter. A walk through which hosted assistants train on conversations by default and where the real opt-out toggle lives is in the assistants that don’t train on your data; this page is the chooser between hosted and local.
Updated October 2026. What changed: re-verified against primary sources on 2026-10-18. Anthropic privacy policy still reads “We may use your Inputs and Outputs to train and improve Anthropic AI models, unless you opt out through your account settings”, and the safety-review carve-out wording “Even if you opt-out, we will use Inputs and Outputs for model improvement when: (i) your conversations are flagged for safety review… or (ii) you’ve explicitly reported the materials to us” still holds. Google Gemini Apps privacy hub still says human-reviewed chats “are not deleted when you delete your activity. Instead, they are retained for up to three years.” Proton’s 2025-08-04 Lumo security-model post still says “no system at Proton can ever read a Lumo conversational history” and “the LLM server forgets the request as soon as the response is generated”. Venice docs still list four modes - Anonymous, Private (“Zero data retention, contract-enforced”), TEE, E2EE. DuckDuckGo’s privacy-terms page still quotes the “at most within 30 days” provider contract and describes Zero Data Retention as a per-chat tier. Brave browser policy still says it does not “store or retain prompts, responses, context, or personal data on our servers. We may cache large prompts to improve performance but these are deleted within minutes”. Mistral legal terms still say “keep your Input and Output until you delete your account or until you delete the conversation from Vibe”, and the Mistral help-center article dated 2026-09-03 now reads “Vibe (Enterprise): customers are opted out of training by default” while Teams/individual users opt out manually; the table row and the Mistral paragraph have been corrected to match. Ollama’s privacy policy (last updated March 2026) still says “We do not collect, store, transmit, or have access to your prompts, responses, model interactions, or other content you process locally.” LM Studio’s app privacy (effective June 2026) still says “the application does not include telemetry or user-specific tracking”; update checks still send app version and IP address. Both OpenAI URLs the previous version of this page cited - help.openai.com/en/articles/5722486 and openai.com/index/response-to-nyt-data-demands - returned a Cloudflare 403 challenge on 2026-10-18, so the OpenAI opt-out / “no longer required to indefinitely retain” passages are carried forward from the 2026-09-29 pass without re-verification today. updatedDate and lastReviewed both set to 2026-10-18.