What AI Tools Log Even In Private Mode

Most AI writing tools now offer some version of a private setting: incognito mode, do not train on my data, zero retention. These settings are usually real and usually narrower than the name suggests.

The gap matters if you are relying on one to satisfy an obligation to a client or a regulator, because “we do not train on your data” and “we do not have your data” are entirely different statements.

Training Opt-Out Is Not Retention Opt-Out

This is the distinction that catches people out most often.

A training opt-out means your text will not be used to improve the model. It typically says nothing about whether the text is stored, for how long, who can access it, or whether it appears in logs.

Retention is a separate control, and where it exists it is often shorter rather than zero. Under frameworks like the GDPR, storage limitation and purpose limitation are distinct obligations, which is roughly the distinction being elided here. A common arrangement is that content is held for a period for abuse monitoring and then deleted, which is a reasonable policy and is not the same as never storing it.

When evaluating a tool, look for two separate answers: is my content used for training, and how long is it retained. A page that answers only the first is answering the easier question.

The Six Things Usually Kept Regardless

Even with the strongest settings enabled, expect most services to hold some of the following.

Account identity. Who you are, your organisation, your billing relationship. Unavoidable if there is a login.

Request metadata. Timestamps, model used, token counts, latency, error codes. This is operational telemetry and it is how the service is run and billed.

Abuse-monitoring copies. Many providers retain content briefly to detect misuse, often described as a limited window with restricted access.

Safety classifier outputs. A record that a request tripped a filter, sometimes with enough context to be meaningful.

Aggregate usage. Volume, frequency, feature adoption. Rarely sensitive individually and quite revealing in aggregate.

Support artefacts. Anything you sent to support, which frequently includes the exact content you were careful about elsewhere.

None of these are scandalous. They become a problem when someone assumed private mode meant none of them existed.

Metadata Alone Can Breach Confidentiality

The comfortable assumption is that if the text is protected, the rest is harmless. In professional contexts that does not always hold.

Timestamps and volumes reveal when a matter became active. A spike in usage the week before a filing is a fact about the matter, not about you. For a law firm, a company preparing an acquisition, or a journalist working with a source, the pattern can be the sensitive part even if the content is sealed.

This is not an argument for paranoia. It is an argument for describing the actual data path when you make a commitment to a client, rather than repeating a vendor’s marketing phrase.

Local Processing Changes The Question, Not All The Answers

Running the model on your own machine removes the largest category by far: the content itself never reaches a server, so there is nothing to retain, subpoena, or leak.

It does not automatically remove the rest. An application can still have an account, still check for updates, still report crashes. The honest framing is private rather than anonymous, and any tool claiming both without explanation deserves a closer look.

Wrivio’s position is deliberately stated in those terms. In Local mode a rewrite makes no network call at all, so the text never leaves the machine. There is still an account for licensing, and there is an optional diagnostics setting that is off by default, cloud-only, and never includes rewrite text. That is a narrower claim than “completely private” and it is one you can verify by disconnecting the network and watching it still work.

How to tell if an AI tool really runs offline covers that verification, and which tasks should stay local covers deciding when it is worth the trade.

Write The Commitment You Can Actually Keep

If a client asks how you handle their material, the answer should describe the path rather than borrow a slogan.

Before:

We use AI tools with privacy mode enabled, so your data is never stored or used for training.

After:

Drafting for your matter is done with a tool that processes text on the machine, with no network transmission of the content. Where we use cloud AI for non-client work, that provider retains content for a limited abuse-monitoring window and does not train on it. We do not send matter documents to cloud AI services.

The second is longer, and it is the one that survives a follow-up question. It also does the useful internal work of forcing you to establish which tools you actually use for what.

A Wrivio Context for client-facing data commitments could say:

Rewrite this as a precise statement for a client. Keep every technical detail, retention period, and product name exactly as written. Do not add guarantees, certifications, or compliance claims that are not already in the text.

Press Ctrl+Shift+Space, paste the draft, and check the diff carefully. Invented reassurance is the specific failure mode here, and it is the one with consequences.

This is a description of how tools behave, not legal advice. If a contractual or regulatory obligation turns on it, have someone qualified review the wording.

Common Questions

Does private mode mean my text is not stored?

Usually not. Most private settings are training opt-outs, which say nothing about retention. Look for a separate, explicit statement of how long content is kept and who can access it.

Why do providers keep content even with retention turned down?

Typically for abuse monitoring, held for a limited window with restricted access. It is a defensible policy, but it means content exists on their systems for a period.

Is metadata really a confidentiality risk?

It can be. Timestamps and usage volumes can reveal when a matter became active, which is itself sensitive in legal, financial, and journalistic work even when the content is protected.

Does running a model locally remove all logging?

It removes the content from the equation, which is the largest part. Account records, update checks, and any opt-in diagnostics can remain, so the accurate claim is private rather than anonymous.

Download Wrivio for Windows to keep confidential drafting on your own machine, where there is no retention window to ask about.