Is it safe to let AI read your messages? A privacy checklist

Letting AI read your messages can be safe, but how safe depends almost entirely on where the text is processed and what happens to it afterwards. On-device AI never sends your chats anywhere; Apple’s Private Cloud Compute and WhatsApp’s Private Processing send them to servers designed not to keep them; ordinary cloud AI stores them for a while and, on consumer accounts, may use them for training unless you opt out. Before you connect any AI tool to your chats, check five things: where the text goes, how long it’s kept, whether it trains models, what the app can reach on your device, and whose words you’re sharing.

This page compares the five privacy models AI messaging tools use, with each provider’s own policy linked, then gives a checklist you can run on any app. That includes ours: Tera Chat is a Mac app that drafts replies with AI, and the last section explains exactly where its AI sends text. Policies were checked on 20 October 2026.

What are the ways AI can read your messages?

There are five, and the differences between them matter more than which AI model is involved:

Model	Examples	Where your text goes	Is it kept?	Used for training?
On your device	Apple Intelligence’s on-device processing; Tera Chat’s voice transcription and red-flag radar	Nowhere: it’s processed on your phone or Mac	Only on your device	No
Verifiable private cloud	Apple’s Private Cloud Compute; WhatsApp’s Private Processing for Meta AI summaries and writing help	Servers built so the operator can’t see the data	Not kept after the request, per Apple and Meta	No
Consumer AI chatbot	Pasting a chat into ChatGPT or Claude	The AI company’s servers, saved in your chat history	Until you delete it, then per the company’s policy	Possibly, unless you turn it off
Your own API key	An app or script using your own Anthropic or OpenAI key	The provider, under its API (business) terms	Anthropic: deleted within 30 days by default	Anthropic: not by default
An app’s own AI service	AI built into an app, routed through the app maker’s server to an AI provider	The app maker’s server, then the provider	Depends on the app: ask	Depends on the app and provider

Is on-device AI the safest option?

Yes, if it can do what you need. When a model runs on your own phone or Mac, the conversation never leaves it, so there’s nothing on a server to leak, keep or train on. The trade-off is power: on-device models are smaller, so Apple sends harder requests to its cloud. Apple says that “to process more sophisticated requests, Apple Intelligence needs to be able to enlist help from larger, more complex models” running in Private Cloud Compute.

Some jobs don’t need a language model at all. Spotting a pattern (an unanswered question, a chat going quiet) or turning speech into text can run entirely on a Mac. If a tool can do a job locally, it should.

What about Apple’s Private Cloud Compute and WhatsApp’s Private Processing?

They’re the most private cloud option available today, with one catch: they protect Apple’s and Meta’s own AI features, so they don’t help when you use another company’s AI tool.

• Apple’s Private Cloud Compute uses your data “only to perform the operations requested by the user”. Apple says “no user data is retained in any form after the response is returned”, and that user data is never available to Apple, “even to staff with administrative access to the production service or hardware.” Apple also committed to publishing the software images of every production build so outside researchers can check those claims (Apple Security Research, June 2024).
• WhatsApp’s Private Processing runs Meta AI features such as message summaries and writing suggestions in a confidential virtual machine “without storing any messages”, and it’s optional (Meta Engineering, April 2025).

Both are designed so that even the company running the servers can’t read what passes through. That’s a much stronger promise than an ordinary cloud service makes.

What happens when you paste a chat into ChatGPT or Claude?

The conversation is stored in your account’s history on the company’s servers, and on consumer plans it may be used to improve the company’s models, depending on your settings.

• ChatGPT: conversations can be used for training unless you turn off Improve the model for everyone in Settings → Data controls. On personal plans, the same setting covers Codex tasks (OpenAI Data Controls FAQ).
• Claude (Free, Pro and Max): since 2025 you choose whether your chats help train Claude. If you allow it, Anthropic keeps that data for up to five years; if you don’t, the 30-day retention period applies (Anthropic, consumer terms update).

Pasting also tends to over-share. A copied thread or a screenshot carries names, phone numbers and things your friend told only you. If you want help with a reply, describing the situation in your own words often works as well, and our guide to using ChatGPT to reply to texts shows how to do it without sounding like a bot.

Is using your own API key more private?

Usually, because business (API) terms are stricter than consumer ones. Anthropic, for example, says it won’t use inputs or outputs from its commercial products, including the API, to train its models by default, and that it automatically deletes API inputs and outputs within 30 days, with exceptions such as enforcing its usage policy or complying with the law. Other providers publish their own API data policies, so read the one you use.

The catch: a key is only as private as the app you put it in. Find out whether that app sends your text straight to the provider or through its own server first.

What can an AI messaging app do on your device?

To read your chats on its own, an app needs permissions, and on a Mac those permissions are broad.

• Full Disk Access lets an app read your iMessage history, but it also opens Mail, Safari data and more. Apple announced on 2 October 2026 that it will add controls so granting it takes “very explicit user action”, warning that “for communication apps, this can also compromise the privacy of the people users are communicating with”. Our Full Disk Access explainer covers what it opens and how to revoke it.
• Accessibility lets an app control other apps, for example clicking through Messages.
• Automation lets an app tell Messages to send a message.

ChatGPT’s Apple Messages plugin is a good example of the pattern: MacRumors reports it needs Full Disk Access, access to contact names and automation tools, and that sending needs your approval by default; OpenAI warns against granting it persistent approval.

Two more things to check: whether the app runs AI in the background (summaries and scans of chats you never opened), and whether it can send on its own. Automatic sending is the riskiest feature for your relationships, and on dating apps it’s also against the rules: Tinder’s and Hinge’s terms ban third-party tools that interact with the service, AI included. See whether using AI breaks Tinder’s rules.

What about the people on the other side of the chat?

They never agreed to your AI tool, and that’s the part most privacy settings ignore. Apple called it out directly in its Full Disk Access announcement, and messaging apps are starting to add controls for it: WhatsApp now has a per-chat Restricted chat setting that stops people in the chat from using Meta AI features or linked devices for it, which WhatsApp says helps keep unofficial clients and AI agents out (About restricted chat). Our guide to turning off Meta AI in WhatsApp and Instagram covers Restricted chat and the other Meta AI controls.

People are wary for a reason. In a June 2025 survey, half of US adults (50%) told Pew that AI will make people worse at forming meaningful relationships; only 5% said better. A respectful approach:

• Share the least you need: one thread, not your whole history.
• Don’t paste health details, money problems or secrets someone told you.
• Keep writing the final message yourself, so the reply is still yours.

The checklist: questions to ask before AI reads your chats

1. Where is the text processed? On your device, in a verifiable private cloud, on the provider’s servers, or on the app maker’s server first?
2. Is it kept, and for how long? Look for a number of days, not “as long as necessary”.
3. Is it used for training, and can you turn that off?
4. Which conversations does it read? Only the one you pick, or all of them, including in the background?
5. What permissions does it need? Full Disk Access and Accessibility are broad; know why each is needed.
6. Can it send messages, and does it ask first? Default to approving every send.
7. Does connecting it break a service’s terms? Dating apps in particular ban connected AI tools.
8. Who runs it? Look for a named company and a plain-language privacy policy.
9. Can you delete everything? Account, history, keys and anything synced.
10. What’s the least you can share to get the help you want?

If an app can’t answer the first four clearly, don’t give it your messages. For a wider look at the tools themselves, see our comparison of AI that replies to texts in your style.

How does Tera Chat handle this?

Here’s how our own app answers the checklist, so you can judge it the same way.

• Storage: your messages, contacts and relationship stats stay in a local database on your Mac and are never uploaded to a Tera Chat server.
• What AI sees: the conversations it works on. That includes features you trigger (Summarize, Draft reply, Ask about this chat) and, once AI is set up, some background features, such as a summary after every 10 new messages, a daily check for life events and the Sunday digest. You can pause background processing in Settings → Pipelines.
• Where it goes, your choice: your ChatGPT account through OpenAI’s Codex (your ChatGPT data controls apply; Tera Chat stores no OpenAI key), your own Claude or Grok API key (straight to that provider, with a daily spend cap, $5 by default), or a Tera Chat AI plan, which sends text to Anthropic’s Claude through Tera Chat’s server, which passes it on and doesn’t keep it.
• What stays on your Mac: voice transcription, red-flag radar, missed cues, fading chats and the health score’s math run without AI. Drafts, summaries and other AI features use your provider’s cloud model, not your Mac.
• What syncs: AI insights and drafts sync between your Macs through your own iCloud account.
• Sending: by default you read and send every message. Autopilot is off until you turn it on for a platform or a chat, and even then it writes drafts that wait for you; automatic sending is a separate Beta switch we don’t recommend.
• Device permissions: Full Disk Access only if you want iMessage, and you can revoke it any time. It doesn’t ask for Accessibility.

The full detail, including the risks we can’t remove, is on is Tera Chat safe, and the setup for each AI provider is in use your own AI with Tera Chat.

What to do next

Pick the AI tool you already use, or are about to, and run it through the ten questions above. Then check two settings today: your chatbot’s training switch, and the list in System Settings → Privacy & Security → Full Disk Access. If anything there surprises you, switch it off.