Private AI Assistants: How to Compare Data, Control and Exit Options

Image: Wade Lambert on Unsplash.

"Private" is not one property. To compare private AI assistants, check six things separately: where your data goes, how long it is kept, what the assistant may do, whether you can see and change its memory, how it recovers, and whether you can leave. Then test the claims that matter to you instead of trusting a label.

This guide gives you the method. It does not crown a winner, because a ranking you have not tested on your own data is just someone else's opinion. For curated lists to run the method against, see the best personal AI agents and the best local AI agents. Both are published by AGNT, which also makes agent software, so apply the same scrutiny to every entry, ours included.

This guide is part of the AI harness engineering guide.

What counts as a private AI assistant?

Products sold under this label do very different jobs. Compare like with like.

Category	What it does	Example question to ask
Model runtime	Runs models on your machine	Does it phone home or use cloud features by default?
Chat interface	A window onto one or more models	Which models does it call, and where do they run?
Workflow tool	Runs automations that may include models	Which services does each step send data to?
Full assistant	Reads your accounts and acts for you	What can it do without asking?

A private chat interface and a private full assistant face different risks. The second has your accounts.

The six dimensions of "private"

Dimension	Question	What good looks like
Data destinations	Where do prompts, documents, embeddings, logs and backups go?	A complete, documented list you can verify
Retention and training	How long is data kept, and is it used for training?	Specific, dated policy for the exact product and endpoint
Authority	What may it read, draft and do without asking?	Scoped access, exact-action approval for consequential actions
Memory control	Can you inspect, correct, export and delete what it remembers?	Records with sources; deletion that explains its limits
Recovery	Can you back up and restore your setup?	A documented, testable restore
Exit	Can you take your data and workflows elsewhere?	Readable exports that import cleanly

Training and retention deserve their own line because they are often blurred. OpenAI's API documentation, for example, says API data is not used for training unless you opt in, and separately that abuse-monitoring logs may be retained for up to 30 days, with exceptions (OpenAI). No training is not no retention.

"Local" deserves care too. Ollama documents a local-only mode that disables its cloud models and web search (Ollama FAQ). That governs the runtime. Any assistant built on top can still add cloud connectors. The local vs cloud vs hybrid guide explains how to trace each component.

Label every claim by its evidence

When you build your comparison, mark each cell with where the information came from:

Label	Meaning
Tested	You checked it yourself, with a date and version
Documented	The vendor's own documentation says so
Not tested	Plausible, unverified
Unsupported	Claimed in marketing, contradicted or absent in documentation

A comparison full of "documented" cells is still useful. It tells you what the vendor is accountable for. It is not the same as a comparison full of "tested" cells, and readers deserve to know which they are reading.

Disclose your own position too. If you sell a product in the category, or earn from a link, say so next to the comparison, not in a footer.

Review each assistant the same way

Use one profile per product, so differences are visible rather than hidden in prose:

1. Category and intended user.
2. Deployment: local, cloud or hybrid, component by component.
3. Data destinations with evidence labels.
4. Retention and training policy, with link and date.
5. Authority model: which actions need approval, and how approval is bound.
6. Memory: can you list, correct, export and delete it?
7. Recovery: is there a documented backup and restore?
8. Exit: what can you export, and does it import elsewhere?
9. Maintenance: who patches what, how often.
10. Limits: what you could not verify.

Point 10 is the one most comparisons leave out.

Choose by constraint, not by universal ranking

There is no single best private assistant. There is a best fit for a set of constraints.

If your main constraint is	Lean towards
Sensitive data must not leave the machine	Local runtime plus a local interface, with every connector reviewed
Strong model quality matters most	A cloud model with a clear API data policy, with sensitive data kept out
Little time for maintenance	A managed assistant with a good export and clear policies
Actions on accounts	Whichever product enforces exact-action approval you can test
Avoiding lock-in	Open formats, documented exports and a tested import path

Sizing local hardware is its own question; the local hardware guide covers it.

Run a personal acceptance test before committing

Spend an hour testing before you connect real accounts:

1. A safe task. Give it synthetic documents and ask questions with known answers.
2. A canary. Include a unique made-up string and check where it appears: network logs, provider dashboards, local files.
3. A denial. Ask it to do something consequential without approval. Confirm nothing happens.
4. A memory check. Tell it a preference, correct it, and confirm the next answer changes.
5. An export. Export everything you can. Open the files. Are they readable and complete?
6. A re-import. If possible, import the export into a fresh install and rerun the safe task.

The evaluation guide expands this into a full suite, and the provider exit test covers step 6 in depth.

Record what you could not verify

End every comparison with its blind spots:

• provider internals you cannot observe,
• exports that exist but you could not import,
• features you did not test,
• versions and prices that will change.

Date the comparison and rerun it when products or policies change. A privacy comparison without a date is already out of date.

Frequently asked questions

Does self-hosted automatically mean private?

No. Self-hosting moves responsibility to you. Connectors, telemetry, logs and backups can still send data elsewhere, and an unpatched server is its own risk.

Can a cloud assistant meet a privacy requirement?

Sometimes. It depends on the data, the provider's policy for the exact product, and what you allow to be sent. Keep the most sensitive data local or out of scope.

Are local chat interfaces and full assistants comparable?

Not directly. A full assistant reads accounts and may act, so authority and approval matter far more.

How should affiliated or sponsored products be handled?

Disclose the relationship next to the comparison and apply the same tests to every product, including your own.