CyphrQ
Menu

On-Device AI Privacy: What Stays on Your Phone and What Doesn't

What on-device AI means, why it helps privacy, and when Apple, Microsoft, Google and local AI apps still send your data to the cloud.

By CyphrQ.ai

Written with AI assistance and human editorial review. Every figure linked to its source.

12 min read

What is on-device AI, and is it more private? On-device AI means the AI model runs on your own phone or laptop, so your words, photos and notes are processed there instead of on a company's servers. That is a real privacy gain. The catch: many "on-device" features hand bigger jobs to the cloud, so you need to know which is which.

Below: how Apple, Microsoft and Google describe their on-device AI, what changes with an open model on your own computer, and how to tell where a feature runs.

Product details checked on 24 October 2026 against each vendor's own pages.

On-device AI privacy: key takeaways

  • On-device means the model runs on your hardware. Cloud means your request travels to a data centre.
  • Apple, Microsoft and Google all mix the two. Bigger tasks can leave your device.
  • Apple's Private Cloud Compute is a middle path: cloud processing that Apple says doesn't keep your data.
  • Local AI apps such as Ollama and LM Studio give you the most control, though Ollama now offers cloud models too.
  • The useful question isn't "is this AI private?" It's "where does this specific feature run?"
  • On company PCs, Recall stays removed unless IT allows it, and local AI apps need checking so they don't open their interface to the network.

What counts as on-device AI?

Every AI feature relies on a model: the software that reads your request and produces an answer. The privacy question is where that model runs.

  • In the cloud: your request goes over the internet to a data centre, gets processed there, and the answer comes back. The company's policies decide what happens to your data next.
  • On the device: the model is stored on your phone or laptop and runs on its own chip. Your request never has to leave.

On-device models are smaller, so they handle narrower jobs. Even Apple, which calls on-device processing "the cornerstone" of its privacy approach, says Apple Intelligence needs to "enlist help from larger, more complex models in the cloud" for harder tasks (Apple Security Research).

Why does on-device AI matter for privacy?

If your data never leaves the device, there is no copy on a server to be kept, reviewed by a person, used for training or exposed in a breach. Those are common concerns with cloud chatbots. The guide to using ChatGPT safely at work covers the cloud assistants' own training and retention settings.

On-device processing can also work without a connection. Google, for example, describes its on-device model as enabling "offline functionality" (Android Developers).

On-device doesn't mean risk-free. The data still lives on your phone or laptop, so a strong passcode, device encryption and installing updates quickly still matter.

How does Apple Intelligence handle your data?

Apple says its on-device models "run entirely on device so that a task can be completed without data leaving your device", and gives Priority Notifications as an example (Apple). Tasks that need more computing power can go to Private Cloud Compute (PCC), Apple's own AI servers. Apple's privacy page gives Image Playground as its example: "when you use Image Playground to generate an image, your device will send your description to Private Cloud Compute", where a server-based model creates the image (Apple).

Apple's security team says a device sends data to PCC "for the sole, exclusive purpose of fulfilling the user's inference request", that no user data is retained after the response is returned, and that it is never available to Apple staff, even those with administrative access (Apple Security Research). That is Apple's stated design.

In October 2024 Apple opened it to outside checking. It published a PCC Security Guide and shared source code for certain key components. It also released a Virtual Research Environment that lets researchers download the software for each PCC release and verify Apple's transparency log on a Mac, and it added PCC to its bug bounty (Apple Security Research).

You can check this yourself. On iPhone, iPad and Apple Vision Pro, go to Settings, then Privacy & Security, then Apple Intelligence & PCC Report. It logs the requests sent off your device and processed by PCC (Apple).

What runs locally on a Copilot+ PC?

Copilot+ PCs are Windows 11 computers with an NPU (neural processing unit), a chip built for AI work. Microsoft's developer guide says that NPU can perform more than 40 trillion operations per second, and describes a set of Windows AI features "designed to run on the device NPU" (Microsoft Learn). "Copilot+" names the hardware class. Microsoft's guide doesn't say every AI feature on the PC runs locally, so check each feature on its own.

Recall is the feature most people ask about. It saves snapshots of your screen so you can search for something you saw earlier. Here is how Microsoft describes its safeguards (Microsoft Support):

  • Opt-in: if you don't choose to turn it on, it stays off and no snapshots are saved.
  • Windows Hello: you need at least one biometric sign-in option (face or fingerprint) enabled to use it.
  • Encryption and storage: snapshots are stored locally, always encrypted, and not shared with Microsoft or third parties.
  • Control: you can filter out apps and websites, delete snapshots at any time, or remove Recall from Windows entirely.

Those safeguards were not all there at the start. In practice: Recall was due to reach Copilot+ PCs as a broad preview on 18 June 2024. On 7 June, Microsoft said it had "heard a clear signal" that it should be easier to choose whether to turn Recall on, and announced changes. Recall would be off unless you switched it on, it would require Windows Hello, and snapshots would be decrypted only after you sign in with it. On 13 June it moved the preview to its Windows Insider testing programme instead (Windows Experience Blog). The lesson for any AI feature: the version that ships may differ from the version first announced, so read the current privacy page.

Local storage keeps the snapshots away from Microsoft, but a searchable history of your screen still sits on that laptop. If you turn Recall on, use the filters to exclude banking, HR and password manager apps and sites.

Does Gemini Nano keep your data on your phone?

Gemini Nano is Google's on-device model for Android. Google's developer page says it delivers generative AI "without needing a network connection or sending data to the cloud". It runs inside an Android system service called AICore, which has no direct internet access and doesn't store any record of your input or the output after processing (Android Developers).

The caveat is on the same page. App developers can use "hybrid inference", which sends requests to Google's cloud Gemini models when Nano is unavailable or unsupported on your phone. So the same app feature could run on one phone and in the cloud on another.

What about running open AI models on your own computer?

You can also download an open model (one whose maker lets anyone download and run it) and run it on your own computer with an app such as Ollama or LM Studio. This gives you the most control, because you choose both the model and the machine.

  • Ollama: "We don't see your prompts or data when you run locally." Ollama also offers cloud-hosted models. For those, it says it processes your prompts but doesn't store or log them. A local-only mode switches the cloud features off (Ollama FAQ).
  • LM Studio: "Nothing you enter into LM Studio when chatting with LLMs leaves your device," and document processing is done locally too. It can run entirely offline once you have downloaded a model. Searching for and downloading models, runtimes and app updates needs a connection (LM Studio docs: Offline Operation).

The trade-off is capability. A model small enough for a laptop is usually less capable than the large models behind cloud chatbots.

Where does each option process your data?

Option What stays on the device When data goes to the cloud What you can see or control
Apple Intelligence Tasks handled by on-device models, such as Priority Notifications Tasks that need more computing power go to Private Cloud Compute; Apple names Image Playground image generation as an example Apple Intelligence & PCC Report logs requests sent to PCC
Recall on Copilot+ PCs Snapshots and associated data, stored locally and encrypted Not sent: Microsoft says Recall snapshots aren't shared with Microsoft or third parties Opt-in, Windows Hello sign-in, app and website filters, delete, remove
Gemini Nano on Android Requests run in AICore, which keeps no record of inputs or outputs When an app uses hybrid inference and Nano is unavailable or unsupported The app developer decides whether to use hybrid inference
Ollama Prompts and data when you run a local model When you use a cloud-hosted model Local-only mode turns the cloud features off
LM Studio Chats with local models and documents you upload Model search and downloads, runtimes and app updates use the internet Can run fully offline once a model is downloaded

How can you tell whether a feature runs on your device?

  1. Try it in airplane mode. If it still works, the processing is local. If it fails or asks for a connection, it uses the cloud. This doesn't prove the feature never sends anything when you're back online, but it's a fast first check.
  2. Look for a transparency log. Apple's PCC Report is one example of a record showing what left your device.
  3. Read the feature's privacy page, not the device marketing. "AI PC" or "AI phone" describes the hardware, not each feature.
  4. Watch for the words "hybrid" or "fallback". They mean the feature can switch to the cloud.
  5. Check the app's cloud settings. Local AI apps may have cloud features switched on. Ollama documents how to turn them off.
  6. Ask the vendor or your IT team one question: "Does this feature ever send my content off the device, and when?"

Going deeper: for security and IT teams

Every "on-device" claim breaks into two questions: where inference runs, and what protects the data at rest and in transit.

Apple Private Cloud Compute. Apple sets five requirements for PCC (Apple Security Research): - Stateless computation: personal data isn't retained after the response, including through logging or debugging. - Enforceable guarantees: the protections are technically enforced and don't depend on external components. - No privileged runtime access: no interface lets Apple's site reliability staff bypass the privacy guarantees, even during an outage. - Non-targetability: reaching one chosen user's data should require attacking the whole system. - Verifiable transparency: researchers can check that production software matches what they inspected.

The mechanisms behind them: a third-party OHTTP relay hides the device's source IP before a request reaches PCC. The Secure Enclave randomises the data volume's encryption keys at every reboot. Devices send data only to nodes that cryptographically attest to running software listed in the public transparency log. The design targets provider insiders and targeted attackers; you still trust Apple's attestation chain (Apple Security Research).

Windows Recall. Microsoft documents snapshots and the vector database as always encrypted, with keys protected by the TPM, tied to the user's Windows Hello Enhanced Sign-in Security (ESS) identity and usable only inside a VBS Enclave. Neither IT admins nor Microsoft can view a user's snapshots. Hardware floor: a Secured-core Copilot+ PC with a 40 TOPS NPU, 16 GB RAM, 8 logical processors, 256 GB storage, BitLocker or Device Encryption, and ESS enrolment with a biometric (Microsoft Learn). Microsoft's September 2024 architecture update added that sensitive content filtering is on by default (Windows Experience Blog).

On managed devices, Recall is disabled and removed by default. The policies sit under Computer Configuration > Administrative Templates > Windows Components > Windows AI, with matching WindowsAI CSP settings: - Allow Recall to be enabled (AllowRecallEnablement): disabling it deletes existing snapshots and removes the component, which needs a restart. - Turn off saving snapshots for Recall (DisableAIDataAnalysis): admins can offer snapshot saving but can't switch it on for users. - Enterprise and Education only: SetMaximumStorageDurationForRecallSnapshots (30, 60, 90 or 180 days), SetDenyAppListForRecall, SetDenyUriListForRecall and SetDataLossPreventionProvider (Purview is currently the only supported provider).

Caveats from the same page: website filters cover only the foreground tab, so embedded content and background tabs can still be captured. On unmanaged (BYOD) Copilot+ PCs, Recall is available by default with no built-in Conditional Access policy.

Local model risks. Treat model files like executables. Hugging Face warns that loading a pickle file, PyTorch's default weights format, can execute arbitrary code; it advises loading models only from trusted publishers and points to its safetensors format (Hugging Face).

Ollama binds 127.0.0.1 on port 11434 by default, and the OLLAMA_HOST variable changes the bind address. Its FAQ suggests a reverse proxy such as Nginx for network exposure and doesn't describe built-in authentication (Ollama FAQ).

In practice: on 1 September 2025, Cisco Talos reported a Shodan study that "identified 1,139 vulnerable Ollama instances", of which 214, about 18.8%, were actively hosting and responding with live models. The largest shares were in the United States (36.6%), China (22.5%) and Germany (8.9%). Cisco recommends authentication, firewall or reverse-proxy access controls, rate limiting and logging (Cisco Talos).

Verifying where inference runs. - Capture the feature's traffic through your proxy or endpoint network telemetry; local inference should produce no request to a model endpoint. - Alert on any listener on port 11434 bound to an address other than loopback, and block inbound 11434 at the host firewall. - Enforce Ollama's local-only mode through your configuration management ("disable_ollama_cloud": true in ~/.ollama/server.json, or the environment variable OLLAMA_NO_CLOUD=1), and alert if it is switched off. Ollama's log then shows Ollama cloud disabled: true (Ollama FAQ). - Ask vendors for the architecture document, not the feature page, and whether any hybrid fallback can be disabled by policy.

When is on-device AI the right choice?

  • Sensitive personal notes: journals, health notes, family matters you want summarised or sorted without a server copy.
  • Travel and patchy connections: flights, roaming, hotel Wi-Fi you don't trust.
  • Work your company hasn't cleared for cloud AI: a local model can help with drafts while the content stays on your managed laptop, if IT allows the app.

Deep research, long documents and the most capable models still mean a cloud assistant, because the larger models run in data centres. Use one on an approved account.

Start this week: pick the AI feature you use most and run the airplane-mode test.

Sources