The state of privacy in personal AI, 2026

A personal assistant may answer a question about tomorrow's meeting, find the document discussed at the last one, and remember that the project has changed owners. Each useful step also extends the system's knowledge of a person. A calendar event reveals a relationship. An email attachment names a client. A recurring search can expose concerns the user has never put in a public document.

The privacy question in 2026 is not simply whether a model trains on a chat. It is where the context is assembled, who can query it, how long copies survive, and which other service receives the answer. A product can promise not to train on your data and still process that data in a cloud service. A local index can keep raw records on a laptop while sending selected excerpts to a remote model. An opt-out from model improvement does not necessarily erase earlier reviews, logs, or copies held by a third-party connector.

View the report's generated cover artwork.

This report compares published product documentation as it stood on 9 October 2026. It covers consumer assistants, enterprise context services, local memory tools and note systems. It is a qualitative map, not a security audit or a claim that one vendor has the largest market share. Where policy language is silent, we record the missing answer rather than infer a guarantee.

The boundary that matters

Consider a straightforward request: "What did we decide about the supplier?" The assistant might receive a carefully selected meeting note, an entire recent conversation, or a broad search over email and documents. It might persist an answer in service memory. If an external model handles the request, at least the selected context crosses a boundary, even if the original database remains local.

Five questions separate these arrangements. Collection: is information explicitly imported, synced through a connector, or captured as ambient screen activity? Storage: are raw data, embeddings and durable memories kept locally, on the provider's systems, or both? Inference: which processor actually reads the retrieved context? Reuse: can chats, ratings or excerpts contribute to future model improvement? Exit: can the user revoke future access and remove existing copies, including backups?

Each question needs its own answer. The phrase "private AI" describes no single architecture or contractual protection.

Figure: Three conceptual paths for personal context across device and cloud boundaries. — three common routes from a source to a response, with the point of off-device disclosure marked.

How this policy comparison was assembled

We read vendor-owned privacy hubs, service documentation, help centers and public policies, and the official legal sources linked below. The selected products represent distinct architectural choices rather than a complete population of vendors. A row in the map describes a particular product or plan, not every service that shares a brand. For example, Microsoft 365 Copilot's enterprise commitments do not describe every consumer Copilot experience, and Recall is a local Windows feature rather than a hosted assistant.

The comparison reads public policies and product documentation. Training restrictions are attributed to the vendors that publish them. Instrumented network checks, account-deletion trials and deployed-model audits are separate forms of evidence. Zortex appears both as the publisher and as a company covered by this review.

Some suppliers have changed their settings and names during 2026. This report cites the actual terms checked and avoids treating a 2024 launch statement as a present-day product contract. Jurisdiction, subscription, organizational settings, feedback submissions and connected integrations can change the result. Readers making a procurement or legal decision should request the applicable agreement, subprocessors list, data-flow diagram and retention schedule.

Market map: who holds the personal context?

The most useful first division is control of the persistent context store, not whether the interface happens to be a chat window. A second division distinguishes context a user deliberately supplies from systems designed to gather information across many applications or over time.

Figure: Qualitative 2026 market map grouped by principal storage boundary and breadth of capture, not market share. — indicative positions; a hybrid product can span more than one cell.

Figure: Counts of selected configurations only, not market or adoption estimates. — of these 12 deliberately selected products, six mainly hold context in a provider or tenant cloud, five in a device or user-operated store, and one uses an explicit hybrid arrangement. These are counts of our examples, not estimates of market share or adoption.

This is not a numerical ranking. A local product can expose a large amount of information if it captures everything on a screen; a hosted product can impose strict enterprise retention and access controls. The map states where the supplier says context lives and how much its design seeks to collect. It does not measure which product is safest under every threat model.

Hosted assistants: the training switch is one control

ChatGPT. OpenAI distinguishes consumer model-improvement settings from the service's ordinary processing of conversations. Eligible consumer users can turn off "Improve the model for everyone"; OpenAI says that new chats then are not used to train its models. Temporary Chat has separate retention and training treatment. Memory, conversation history, connected apps and information sent to a third-party action need separate review. Business, Enterprise, Edu and API services have different default training commitments from consumer accounts. A policy decision made for one tier should not be carried over to another without checking it.

Claude. Anthropic's March 2026 consumer policy explanation says consumer chats and coding sessions can be used for model improvement when a person chooses to allow it, under specified safety-review conditions, or through another explicit opt-in. It distinguishes raw connector content from material copied into a conversation. Incognito chats are not used for Claude improvement. Feedback is another channel: Anthropic states that feedback-related conversations may be held for up to five years. The lesson is not that all connector records are training data; it is that ordinary conversations, copied snippets, safety handling and direct feedback have different rules.

Gemini Apps. Google's current Gemini Apps Privacy Hub is more complicated than a binary training toggle. With Keep Activity on, chats and shared material can contribute to service improvement, including model training, with some human review. Users can turn Keep Activity off or use temporary chats, but processing for response generation and safety continues. Google also explains that certain reviewed material can outlive deletion from user-visible activity. A separate setting in another Google service is not automatically controlled by the Gemini switch. Anyone connecting Google Photos, Drive, email or other apps needs to inspect how the source data enters the final prompt.

Perplexity. Search queries can be personal history when collected for months. Perplexity describes consumer search, usage and feedback collection, and provides an AI Data Usage control; the arrangement differs for Enterprise and API products. Eligible memory features, including those described for Perplexity Max, add another store of inferred interests and previously useful facts. Turning off model-training use does not by itself answer when query history or a remembered fact is deleted. The questions for a buyer are what memory is created, which sources feed it, and which controls cover existing material rather than only future collection.

Microsoft 365 Copilot. A work tenant creates a different bargain. Microsoft's enterprise data protection description says prompts, responses and Microsoft Graph data are not used to train foundation models. Processing nevertheless occurs in Microsoft's enterprise service, using organizational access controls, retention and compliance features. An employee's permission to find a document through Microsoft 365 matters because grounding can make that document available in an answer. Enterprises should review oversharing in the source tenancy rather than assume the assistant itself creates the underlying authorization problem.

NotebookLM / Gemini Notebook. Research notebooks are intentionally scoped collections rather than whole-life memories. Google's notebook-specific terms distinguish source files from feedback and certain other interactions. The general principle is useful: narrower ingestion reduces the material available to a prompt, but notebooks may still be service-hosted and subject to account and feedback policies. A deliberate notebook can be the appropriate choice for one research project without becoming an indefinitely growing profile of the researcher.

Device-first and self-managed systems: local is a boundary, not a cure

Apple Intelligence is an integrated, hybrid architecture. Apple describes on-device processing for tasks that can run locally and Private Cloud Compute for requests needing additional compute, with a stated design that does not store those requests or make them accessible to Apple. That is a more specific architectural claim than a general promise to protect user data. An optional external model or extension is a separate receiving party. The distinction is particularly important when someone says all Apple Intelligence processing happens on-device; Apple itself does not make that blanket claim. See Apple's privacy documentation.

Windows Recall offers a useful counterexample to the assumption that local capture is always narrow. Microsoft says supported Recall snapshots are saved and analyzed locally, encrypted, and require opt-in, with identity checks for access. On managed devices, Recall is disabled and removed by default unless made available under organizational policy. The retained material can nevertheless describe a large portion of what appears on a screen. Users still need filters, storage bounds and an understanding of what is excluded. Read Microsoft's Recall management documentation.

PiecesOS describes an on-device context engine for developer activity and long-term memory, with options to involve remote models. Its architecture documentation helps distinguish local capture and indexing from the later context passed to an inference provider. The relevant verification is whether all chosen model routes, analytics and update services behave as expected in the specific configuration. A vendor's local-first statement is evidence of intent and published design, not a substitute for a data-transfer inspection.

AnythingLLM can be deployed on user-operated hardware, and an offline local model can keep prompts and documents within that environment. The self-hosted project terms distinguish this setup from third-party integrations. If the user adds a commercial inference API, selected context is sent to that API under a different provider's policy. This is a recurring principle of self-hosting: control of the storage box and control of the inference endpoint are different decisions.

Obsidian keeps an ordinary vault as user-held files; optional Obsidian Sync and plugins can change processing and replication. It is primarily a knowledge application, not a turnkey personal AI agent, and belongs in the map as a baseline for user-controlled notes. Its data storage explanation gives users an unusually tangible answer to the export question: the original files are not wholly dependent on one assistant interface. The privacy boundary becomes less clear when a plugin indexes notes to a cloud vector store or sends them to a hosted model.

Zortex, the publisher of this report, is building a Windows/macOS desktop context engine connecting apps into a local world model. Its application policy says synced Google information, indexes and credentials are held on the device, but does not claim universal full-vault encryption. It describes AES-256-GCM for OAuth secret cells and a Cloudflare-hosted token broker that handles authorization credentials. When a user sends permitted context to a connected assistant through MCP, that assistant receives the result; a cloud provider can then process it under its own rules. Zortex states it does not use Google user data for generalized model training. Disconnecting a connector stops authorized access but does not erase prior local copies. Zortex's inclusion is that of the report publisher, and the cited application policy supplies the basis for its product claims.

Chart 1: how the controls differ

Figure: Publicly documented privacy controls by stage, not product safety scores..

The chart organizes the type of documented control, not an invented privacy grade. Its columns ask where a user can intervene: at capture, at durable storage, at training reuse, and at onward disclosure to another model. A mark means the cited documentation describes a meaningful control in that category; it is not a pass/fail finding and does not establish that the control is enabled by default.

The table exposes why an all-purpose privacy score would be misleading. A clinician choosing a local workflow may prioritize no off-device data transfer. A regulated employer may prioritize an auditable tenancy, retention controls and legal review. A student may simply need a notebook that will not train on private drafts. The same product will not be optimal for all three.

What legislation changes in practice

A privacy policy is not the whole legal story. A provider can publish accurate data-flow language and still collect too much information for a stated purpose. Conversely, a lawful processor may retain limited security records after a user deletes an account. Legal analysis depends on roles, geography, source data, user expectations and actual processing. The following is a product-design guide, not legal advice.

European Union: GDPR reaches the context store

The GDPR principles published by the European Commission require an appropriate lawful basis, clear purposes, data minimization, accuracy, bounded retention, security and accountability where the regulation applies. Personal AI complicates these familiar requirements because information is gathered for one apparent task and later reused to answer unforeseen questions.

A sync engine cannot assume that because a user can read an email, every personal detail about its sender can be retained indefinitely for unrelated profiling. A vendor must determine its own legal role and basis, especially where records concern colleagues or customers who never directly signed up for the assistant. Sensitive information inferred from ordinary text may raise additional concerns. Query results, embeddings and long-lived memories may themselves be personal data; changing the storage format does not automatically take them outside the law.

The right to access or erase data requires an inventory. That inventory may include original content, extracted text, search indexes, embeddings, summary records, preference memories, provider logs and backups, subject to applicable exceptions. Deletion requests should identify what can be removed and the separate retention limits for what cannot. EU guidance on individual rights is relevant to any service that can retrieve intimate context about identifiable people.

The European Data Protection Board's Opinion 28/2024 also warns against assuming that an AI model is automatically anonymous just because the original database has been removed. Anonymity and legitimate-interest reasoning require case-specific examination. For product teams, the safest engineering habit is to minimize what is copied into training or durable derived stores before those stores become difficult to inspect.

European Union: the AI Act is not a universal chatbot license

The AI Act implementation timeline now includes changes from the AI Omnibus, which entered into force on 27 July 2026. General-purpose model provisions began applying in August 2025; many rules, including Article 50 transparency obligations, began in August 2026. There are transitional provisions for certain AI-generated-content systems in December 2026. The amended dates for high-risk Annex III systems and high-risk AI embedded in regulated Annex I products are 2 December 2027 and 2 August 2028 respectively.

Those dates should not be read as saying that every personal assistant is a high-risk system. Classification depends on the intended use. Helping someone summarize their own research is not identical to deciding eligibility for employment, credit, education or essential services. A context product that later powers such a decision inherits different responsibilities through the application into which it is integrated. Model providers, deployers and downstream developers may have different duties.

The practical design response is traceable purpose and role separation. Record whether a system retrieves information, recommends an action, or materially affects a consequential decision. Preserve human review where required; disclose relevant AI involvement and AI-generated content where obligations apply. The AI Act does not displace the GDPR's rules governing personal data.

United States: state privacy duties and effective dates

There is no single comprehensive federal consumer privacy law equivalent to the GDPR. State laws and sector-specific rules require a narrower jurisdictional analysis. The California Privacy Protection Agency's adopted rulemaking took effect on 1 January 2026 and addresses updated CCPA requirements, risk assessments, cybersecurity audits and automated decision-making technology, with some obligations subject to phased implementation. California consumers' rights and businesses' duties cannot be reduced to a single training opt-out.

Colorado illustrates the cost of relying on an old regulatory calendar. The state enacted SB26-189 in May 2026, repealing and reenacting the earlier 2024 AI-specific provisions. Its requirements for covered automated decision-making technology materially influencing consequential decisions begin 1 January 2027. The enacted summary describes technical documentation, notice, rights to correct factually incorrect data, and human review following specified adverse outcomes. This is not a blanket rule governing every AI writing assistant.

Separate state privacy statutes, including the Colorado Privacy Act, already create obligations around personal data, sensitive information, profiling and consumer requests for covered organizations. A product team should map where residents are, which entities qualify, and whether the application makes consequential decisions. Merely labeling the AI a "copilot" will not determine the legal classification. User access to confidential records also remains constrained by employment, health, educational and contractual rules outside general privacy statutes.

China: PIPL controls purposes and exports

China's Personal Information Protection Law applies to specified handling of personal information in China and also reaches certain processing outside China involving people there. It contains consent and other lawful-processing requirements, special protections for sensitive personal information, individual rights, duties for entrusted processing and conditions for cross-border transfers. An AI tool importing a Chinese user's workplace information cannot treat the transfer as a mere engineering choice.

Articles governing overseas provision of personal information and related procedures can require particular transfer mechanisms and notices. The Cyberspace Administration's March 2024 provisions adjust some cross-border-data-transfer requirements and exceptions. Saying that all personal data must remain physically in China is too broad; saying that anyone may send it abroad after a click is also inaccurate.

This matters particularly for context engines that blend local files with hosted embeddings, monitoring, and external inference. A cloud inference request containing a few retrieved email paragraphs can itself be an overseas transfer. Storage locality alone does not answer where processing or authorized onward use occurs.

Figure: Selected regulatory milestones and implementation dates relevant to personal AI. — enacted dates relevant to this report, not a complete compliance calendar.

Four changes visible in 2026

Memory is turning into a separate data product. A past conversation is history; a model of recurring preferences, relationships and unfinished work is a derived record. Users need to see which claims the system believes, their source, their age and how to correct them. Otherwise a false inference can propagate to later tools more efficiently than a mistaken chat message. A memory toggle is valuable, but legible provenance and selective deletion are stronger tests.

A connector may have wider rights than the feature uses. OAuth grants, enterprise Graph permissions and browser-based access are different from the product's description of a task. The permissions requested on a provider's consent screen can be broad even when the present feature only performs search. Teams should distinguish technically authorized access from actual queries made, and record the least-privilege controls enforced downstream. In the Zortex application policy, for example, some declared Google scopes are broader than the documented product operations; that is a fact a serious evaluation must retain.

On-device inference is growing, while hybrid execution remains common. Local operating-system features and self-hosted retrieval change the risk associated with routine access and centralized breaches. They also shift responsibilities to device security, backups, malware resistance and capture settings. Remote fallback may still be valuable for quality or speed. Its activation should be visible at the moment relevant personal content leaves the device, not concealed behind an undifferentiated "private" label.

Exit is becoming a product feature. A user may switch models without switching the archive, but only if the context layer is portable and permissioned. Exporting raw notes is useful. Exporting a proprietary embedding file with no references, source permissions or timestamps may not be. Switching an assistant also raises the question of what the previous provider keeps. We expect buyers to ask for deletion verification and an intelligible export format, not merely for a checkbox titled "Delete account."

These are qualitative observations derived from the products and documentation reviewed here. We offer no unsupported percentage for adoption, incidence of breaches, or size of the market. Public policy cannot establish how frequently a feature is used or whether its technical isolation succeeds under attack.

What to watch through 2027

The meaningful signals will be specific. Does a memory product show the record and citation used to construct a preference? Can a user delete one source and have its derived memory, search representation and permitted replicas expire on documented schedules? Are cross-model transfers displayed before a context payload is sent? Can a business distinguish the logs necessary for security from copies retained for model improvement? Is an AI's permission limited to a project, time window or source, rather than the whole account?

Regulation supplies additional dates to monitor: California's implementation of its 2026 rules; Colorado's consequential-decision requirements on 1 January 2027; and the EU's amended December 2027 high-risk date for Annex III. Those are reasons to test an actual use case against current law, not reasons to stamp every consumer assistant "compliant" or "noncompliant."

For procurement, ask a provider to demonstrate six things on a disposable account: connect a data source; inspect the granted scopes; show the raw record and its derived memory; send a prompt and identify every off-device recipient; revoke access; then document what is deleted, delayed or retained. Repeat with a different model. A company that cannot narrate this path cannot give the buyer a reliable map of the information it handles.

For personal use, the decision can be simpler: keep sensitive source collections narrow, disable training use where offered, inspect connected-app permissions, and treat a cloud-model handoff as a disclosure. Local storage and enterprise contracts can improve the boundary, but neither eliminates the need to check what happens after retrieval.

Sources and scope

The map covers the twelve identified configurations and the laws and policies reviewed on 9 October 2026, rather than every product or deployment. Positions describe published designs and controls; they are not measurements of breaches, security posture, privacy compliance or market share. The three charts and market diagram are categorical charts assembled for this report, distinct from independently reported statistics and rankings. Their source can be regenerated from the diagram-generation script. The site's article renderer supports inline diagrams from nested local asset folders.

Principal product-policy sources appear in each market-table row and product passage. Regulatory primary sources appear beside the dates and duties they support. Zortex product claims are attributable to its application privacy policy, not to an independent audit. The result remains subject to change when services update their privacy terms or when a specific deployment differs from public documentation.

The central question for 2027 is testable: when a person shares one fact with one assistant for one purpose, can they still identify—and end—the life of that fact everywhere the system copied or inferred it?