The deeper AI gets into your devices, the more it's worth asking seriously: where does my data go? This article won't scare you — it explains the two common approaches and how to tell them apart.

First, what data is produced at which stage

When you use AI to control a device, several types of data arise:

  • Operation records: what you asked the AI to do, which steps ran, and the result.
  • Device information: model, version, current screen, and so on.
  • Content data: your messages, contacts, and anything typed into forms (depending on what you ask it to handle).
  • Account data: account-related information, if you log in.

Each stage may send data to very different places.

Two typical approaches

Upload-by-default: the tool sends operation records — even live screen content — to the cloud by default, with little visible sign and few ways to turn it off.

Local-first: records and task data stay on your own PC by default; only when AI needs to orchestrate a new task does it go online, and you can see what's used, what's sent, and when.

Four questions to ask any tool

  • Where does it default to? Local by default, or cloud by default?
  • When does it go online? Streaming constantly, or only on demand?
  • Can you turn it off? Is there a clear switch when you don't want to upload?
  • Can it explain itself? Does the documentation or settings clearly answer the three questions above?

Why local-first feels safer

Local-first isn't "fully offline" — it's handing control back to you: conservative by default, networked features triggered explicitly. The content you handle leaves your PC only when necessary, with a clear, checkable, controllable trail.

For people handling sensitive content (messages, contacts, work files), "local by default + on-demand networking" is far more reassuring than "upload by default."

A few extra things you can do

  • Prefer tools that keep data local by default.
  • Log in only when needed; use core features daily without an account if possible.
  • Occasionally open the settings, read any "data"-related options, and understand them.
💡 Transparency is the best security policy. If a tool can't even explain where your data lives, choose one that can.