Everyone agrees that AI should be private. Almost nobody agrees on what "private" means. OpenAI says ChatGPT is private. Google says Gemini is private. Apple says Apple Intelligence is private. And the marketing page for every AI "privacy-focused" app on earth says the same thing.
They can't all be right. This post is about the one definition of private AI that isn't negotiable — the one where your words physically can't leave your device — and why anything less is a trust exercise you probably shouldn't be running with your sensitive data.
The three meanings of "private AI"
1. "We won't train on your data"
This is the weakest form. The provider receives your prompt, logs it, processes it on their servers, and promises not to use it to train future models. You're trusting that the promise holds, that there are no bugs, that no employee looks at it, that no government subpoenas it, and that the company doesn't change the policy later. ChatGPT's Team plan, Claude's API, and most enterprise AI services live here.
2. "End-to-end encrypted in transit and at rest"
Slightly stronger. Your prompt is encrypted as it travels to the server and while it sits in storage. But the provider's servers still see the plaintext — encryption in transit is not encryption from the provider. Apple's Private Cloud Compute is the most serious version of this: stateless, hardware-attested, and designed so Apple literally cannot read the prompts. It's a big improvement but still depends on hardware verification and audit chains most users will never check themselves.
3. "The prompt never leaves your device"
The only version that doesn't require trust. The model runs on your phone. The prompt is processed on your phone. The reply comes back on your phone. There is no server involved, no network request, no "we promise not to peek" — there's no one who could peek. This is what on-device AI actually gives you.
Turn on airplane mode and try the app. If it still works, it's truly private. If it fails with a "connect to the internet" message, the definition of "privacy" the company is using is one of the softer ones.
What cloud AI providers actually log
Even the "we don't train on your data" providers still keep logs. They have to — for abuse prevention, safety review, and legal compliance. Here's the rough shape of what lives on their servers when you use a cloud chatbot:
- The full text of every prompt. Usually retained for at least 30 days, sometimes much longer for paid or enterprise accounts.
- The full text of every reply. Same retention.
- Metadata: account ID, IP address, timestamps, device fingerprint, geolocation at the time of the request.
- Flagged conversations that tripped safety classifiers are retained longer and may be reviewed by human contractors.
- Aggregated usage data for product analytics — which features you use, how often, where you get stuck.
Most of that is benign and expected for a cloud service. But "benign" and "private" are different words. If you asked a cloud chatbot about a health symptom last week, that question is in someone else's database right now, associated with your account.
Who cares about this, practically?
Not everyone needs total privacy every time. Asking ChatGPT for a lasagna recipe is fine. The people for whom this matters are the ones who already know who they are:
- Doctors and therapists handling patient information covered by HIPAA or GDPR Article 9.
- Lawyers with privileged client communications.
- Journalists protecting sources.
- Researchers working with unpublished data.
- Executives drafting strategy under NDA.
- Anyone asking about mental health, relationships, finances, or any other topic they wouldn't want permanently tied to their name.
For these users, "we don't train on your data" is not sufficient. A single breach, a single subpoena, a single policy change — and the entire defense collapses retroactively for everything they've ever typed.
What on-device private AI actually protects
When the model runs on your iPhone, you get guarantees that are physical, not policy-based:
- No server logs. There is no server. No one is writing your prompts to a database.
- No training set contamination. Your prompts can't accidentally end up in a future model's training data because they were never sent anywhere to be harvested.
- No subpoena risk. You can't compel someone to produce something they never had.
- No breach exposure. Data breaches can only leak data you stored. If the data never left your device, a breach at the AI provider doesn't touch you.
- No policy-change regret. Future terms of service can't retroactively grant the provider new rights to your old prompts, because the provider never had your old prompts.
Apple Intelligence and Private Cloud Compute
Apple has done the best work in the industry on cloud-adjacent privacy. Apple Intelligence runs as much as it can on-device and, when it can't, falls back to Private Cloud Compute — a stateless server architecture Apple designed so that even Apple employees can't read prompts. It's audited, hardware-attested, and verifiably deleted after each request.
It's genuinely impressive and dramatically better than the default cloud AI model. But it's still not the same as on-device. "Apple cannot read your prompts" is a stronger promise than OpenAI's, but it's still a promise backed by architecture and audits. On-device needs no promise at all — the prompt physically never leaves the chip.
The right way to think about it: Apple Intelligence is great for things too big to run locally. On-device AI is great for everything else. These aren't competitors; they're complementary layers.
The trade-off, honestly
On-device AI isn't magic. In exchange for physical privacy, you accept some real limits:
- The models are smaller, so they're slightly less capable on the hardest prompts. A 3B on-device model does not match GPT-4o on long reasoning chains.
- You use some storage. A model file is typically 1–4 GB.
- You use some battery. Running neural networks is real work.
For most daily tasks, those limits don't matter. For tasks where the strongest possible model is required and privacy is not critical, cloud AI is still the better tool. The right answer is usually "both" — use on-device for anything sensitive, anything offline, anything frequent, and use cloud for the occasional hard problem where you're comfortable with the trade.
What PocketLLM does
PocketLLM is the on-device layer. Every prompt runs locally through Apple's Neural Engine. Nothing is logged, because there's no server. There are no accounts. There is no telemetry on your conversations. The app file on your phone contains an AI that works exactly the same whether you're on fast Wi-Fi or the moon.
That's the whole pitch. Not "we promise not to peek." Not "we anonymize it." Just: the prompt never leaves the device.
The one sentence version
Every other definition of private AI is a policy. On-device AI is a physical property. Policies change; physical properties don't. If your prompts matter, you want the physical property.