Local AI Isn't Automatically Private Anymore

For a couple of years, "run it locally" was a complete answer to the privacy question. You downloaded a model, you ran it on your own hardware, and your prompts went nowhere. There was nothing to trust, because there was no one to trust.

That answer now needs a footnote, and the footnote is the interesting part.

What changed

The tools that made local models easy have added hosted options. Ollama is the clearest example, because it's the one most people mean when they say they're running models locally. It now offers cloud models alongside local ones. You pull a model whose tag ends in -cloud, and it behaves almost exactly like a local model. Same command, same interface, same muscle memory.

The difference is that your prompt leaves the machine.

I want to be fair here, because this is not a scandal and Ollama has not been sneaky about it. Their privacy policy is clearer than most. For local models it says, plainly, that they do not "collect, store, transmit, or have access to your prompts, responses, model interactions, or other content you process locally." For cloud models it says prompts and responses are processed "transiently" and are "not stored beyond the time required to fulfill the request", and that inputs and outputs are not used to train models. Data may be transferred to and processed in the United States.

As policies go, that's a good one. It's specific, it distinguishes the two cases, and it doesn't hide behind "we take your privacy seriously".

The distinction that actually matters

Read those two paragraphs again and notice they are different kinds of statement.

The local one describes architecture. Ollama can't access your local prompts because there is no mechanism by which they would reach Ollama. It isn't a promise not to look. There's nothing to look at.

The cloud one is a commitment. Prompts do reach their infrastructure, and their partners' infrastructure, and the guarantee is that nothing is retained or trained on. To hold, that has to be honoured by Ollama, by every inference provider in the chain, this quarter and every quarter after, through acquisitions, policy revisions, subpoenas and breaches.

Both can be entirely honest. They are not equally durable. A promise is a policy; architecture is a fact. You want as much of your privacy as possible resting on the second one, because the second one doesn't have a renewal date.

This isn't specific to Ollama. It's the shape of what's happening across local-first AI tooling: a free local tier, a paid hosted tier, and one interface over both. Commercially it's the obvious move. It just means "I use a local AI tool" has stopped being the same claim as "my data stays on my machine".

How to actually check

Worth twenty minutes on any tool you've been treating as private.

1. Look at the model tag. In Ollama's case a -cloud suffix means hosted. Other tools mark it differently, or not at all.
2. Watch the network. Run your normal workflow with the machine offline. Anything that breaks was talking to something. This is the only check that can't be wrong.
3. Find the two-paragraph split. Any honest tool with both modes will describe them separately, as Ollama does. If a privacy policy talks about "your data" as one undifferentiated thing while the product has a hosted tier, that's the tell.
4. Check the defaults, not the capabilities. What matters is what happens when you don't think about it, and whether a fallback to a hosted model can happen quietly when a local one is missing or too slow.
5. Re-check after updates. Features move across that line. The version you audited is not necessarily the version you're running.

Why I keep going on about this

I build privacy-first software, so I have an obvious stake. But the reason I find this worth writing down isn't competitive. It's that the vocabulary is quietly degrading.

"Local", "on-device" and "private" were useful words precisely because they described where computation physically happened. As they get attached to hybrid products, they stop carrying that information, and users lose the ability to reason about their own exposure from the label alone. That's a real loss, and it happens gradually enough that nobody objects at any single step.

The fix isn't to distrust the tools. Ollama's cloud tier is a legitimate product, and plenty of work doesn't need local inference at all. The fix is to keep asking a boringly specific question, for this feature, right now, where does my prompt go?, and to be suspicious of any answer that's a promise where it could have been a fact.

If the honest answer is "it goes to a server, and they've promised not to keep it", that can be fine. Just decide it deliberately, rather than inheriting it from a word that used to mean something else.