Checking if a tool is really private

Every privacy claim you have ever read is a sentence somebody wrote. This chapter is about the difference between a sentence and a fact, and the four tests that let you tell them apart without knowing anything technical.

Claims are not evidence

"We never see your data." "Your files never leave your device." "Private by design." These may all be perfectly true. The problem is that the honest company and the careless one write exactly the same sentence, and you have no way to tell them apart by reading.

So don't read. Test. The four tests below run from ten seconds to about ten minutes, and any of them tells you more than an afternoon of comparing privacy policies.

The four tests

The airplane-mode test. Disconnect from the internet completely, then use the tool as you normally would. If it still answers, the work happened on your machine — there was no connection for it to happen anywhere else. If it stalls or shows an error, something in that process needed a server. This is the same test from Chapter 03, and it's still the most informative ten seconds you can spend.
The idle test. Reconnect, open the program, and then leave it completely alone for a while. A tool that works offline can still send information later, when you're not looking. What you're checking for is telemetry — background reports about how you use a program. Telemetry isn't automatically sinister, and plenty of good software collects it. You just want to know it exists before you decide how you feel about it.
Watch the connections. Your computer already has a tool that shows you which programs are talking to the internet: Activity Monitor on a Mac, under its Network tab, and Resource Monitor on Windows, under Network. Open one, find your AI tool in the list, and watch. A genuinely local tool sitting idle should be quiet. If you want to go further, several small programs exist that ask your permission before any program makes a connection — heavy-handed for daily use, excellent for a single evening of finding out what your machine actually does.
Read for three sentences, not the whole policy. Nobody reads privacy policies, and reading one end to end is a poor use of an evening anyway. Search the document for three things instead: what is collected, where it is processed, and who else receives it. If any of those three is hard to find, that's your answer — a company that keeps its data practices simple has no reason to bury them.

What "we don't train on your data" actually promises

Less than it sounds like. It's a statement about one specific use — improving their model. On its own it says nothing about whether your information is stored, for how long, who at the company can read it, whether it's shared with other companies that help run the service, or what happens to it if the business is sold. It's a real promise and worth having. It just isn't the promise most people hear.

Three phrases worth slowing down for

"Enterprise-grade security." This describes how well they defend your data from outsiders. It says nothing at all about what they themselves do with it. A vault can be both extremely secure and full of people reading your mail.

"Your data is encrypted." Almost always true, and almost always beside the point. Encryption protects information while it travels and while it sits on a disk. If the company holds the keys — and unless they specifically say otherwise, they do — they can still read it. The phrase you're looking for is end-to-end encrypted, which means the provider genuinely cannot.

"Processed locally where possible." Every word before "where possible" is doing no work. Who decides what's possible, and how would you know when it wasn't? Compare that to a plain statement that the tool runs entirely on your device and works with no connection — a claim you can check in ten seconds using the first test above.

The honest limit of all this

None of these tests proves a program will never send anything anywhere. Proving that would take skills well beyond this guide, and frankly beyond most professionals. What these tests give you is something more practical: evidence about what a tool does under conditions you control, gathered by you rather than promised by someone selling it. That's enough to make a good decision, which is the actual goal.

How much checking is enough

Match the effort to what's at stake. For a tool you'll use to draft grocery lists, the airplane-mode test is plenty. For something you're about to point at your medical records, your finances, or a family member's private letters, spend the ten minutes and run all four.

And notice what this chapter has quietly given you: you no longer need this site to tell you which tools to trust. The recommendations in Chapter 01 are just tools that pass these tests. Now you can run them yourself, on anything, including tools that don't exist yet.