Turn off the Wi-Fi and generate anyway

There is a privacy audit anyone can run in five minutes, and it does not involve reading a single policy. Load an AI model onto your own computer. Ask it to generate something. Then turn the Wi-Fi off and ask again. If the answer still streams in, you have just proved where your prompt went: nowhere.

That proof is the difference between two kinds of AI privacy. Cloud privacy is a promise written in a document, and some of those documents are genuinely good. Local privacy is a property of physics you can test on demand. This post walks through the test, reads the cloud’s fine print fairly, and then draws the part most privacy posts skip: an honest map of which paths in a real AI app are on your machine and which never were.

Cloud privacy is a promise; local privacy is a test

Every assurance a cloud AI service gives you shares one structural weakness: it describes behavior on servers you will never see. The company may honor it completely. You still cannot check. You can only collect promises, and organizations know how fragile that is. In Cisco’s 2024 Data Privacy Benchmark Study, 27% of organizations said they had banned generative AI outright for a period, 63% limited what data employees could enter, and 48% of users admitted putting non-public company information into these tools anyway.

The bans were a blunt answer to a real question: how do you let people use AI on material that must not leave the building? A contract under NDA. A patient note. An unannounced product. For that material, “we have a strong retention policy” is a different kind of answer than “the data has no route out.” We have covered what the consumer chatbots do with your conversations before; the short version is that the defaults reward reading the settings.

A model running on your own hardware changes the epistemics, not just the risk. The claim “your prompt never leaves the machine” stops being marketing and becomes falsifiable. You can turn the network off and watch the claim survive. No cloud service can offer you that experiment, at any price, because their product is on the other side of the wire.

The airplane-mode test takes five minutes

Here is the whole protocol, written so you can reproduce it rather than take a screenshot on trust.

Step one: get a model onto disk. Install a local runtime and pull a model while you are still online. Ollama is the common choice, and apps like ours bundle it so the pull is a click. The download is the last time those weights touch the network; a 12B text model is roughly an 8 GB file that wants 16 GB of system RAM, while a small 3B or 4B model runs happily in 8 GB. (Our RAM and VRAM guide maps model sizes to hardware.)

Step two: generate once with the network on. This confirms the model runs and warms it into memory, so the offline run is a fair comparison.

Step three: kill every connection. Airplane mode on a laptop, or Wi-Fi off plus the Ethernet cable out. Pull it mid-session; the point is that the app must not get a chance to prepare.

Step four: generate again, and make it sensitive-shaped. Paste a fake contract clause or an invented patient note. The response streams in at the same speed as before, because the request went to a server on your own machine, answered by weights read off your own disk. Ollama’s own FAQ states the underlying fact plainly: “Ollama runs locally. We don’t see your prompts or data when you run locally.” The airplane-mode test is how you check that sentence instead of quoting it.

Skeptics can go one layer deeper without much effort. Leave the network on, open a connection monitor (Little Snitch on a Mac, or a plain terminal listing open sockets), and watch what the runtime does during a generation. A local inference call is a request to 127.0.0.1, the address that means “this machine.” Traffic to that address never reaches your network card, which is why the test works even before you touch the Wi-Fi toggle. The airplane-mode version is simply the demonstration that needs no tools and no trust in your own reading of a packet log.

What you have at the end is not a feeling of privacy. It is an observed fact: with the network dead, the prompt and the output had no route off the machine. That fact holds for every generation you run on that path, online or not. And it composes: the same test covers local image models, local speech models, anything whose weights sit on your disk. One switch audits the whole family.

The cloud’s fine print is better than its reputation

Being honest about local AI requires being honest about cloud AI, and the cloud’s published terms are better than most people assume. OpenAI’s API data controls state that API data has not been used to train its models by default since March 2023, with abuse-monitoring logs kept up to 30 days and a zero-retention arrangement available to approved organizations. Anthropic’s API retention page goes further: conversation content is not retained by default at all.

The exceptions are where the lesson lives. Anthropic’s newest models are designated “covered models” that require 30-day retention and are excluded from zero-retention arrangements entirely. Google’s Gemini API terms split on billing: paid usage is not used to improve products, while the free tier is, human reviewers included, with the terms warning “do not submit sensitive, confidential, or personal information to the Unpaid Services.” Same product, same prompt box, different privacy depending on which quota answers.

The hosts our own app uses for cloud generation follow the same pattern of unevenness. Replicate deletes API prediction inputs and outputs after about an hour by default, one of the tightest windows published anywhere, yet predictions made through its website are kept indefinitely. Runware’s privacy notice commits to keeping information only “as long as necessary” but publishes no specific window for inference data, so the honest reading is that no number has been promised.

Policies also answer to forces above the vendor. When a court ordered OpenAI to preserve consumer chat logs during a copyright lawsuit, chats users believed deleted were held for months regardless of what the privacy page said; we walked through that episode in detail. The vendor was not being dishonest. The vendor was simply not the final authority over data sitting on its servers, and no vendor ever is.

None of this is an accusation. It is the nature of the instrument. Every row in that table is a document that can be revised, carries exceptions its own vendor added later, and describes machines you cannot inspect. A policy is a dial on someone else’s desk. For most work that trade is fine, and the cloud’s biggest models are genuinely better. The question is never “cloud bad, local good.” It is which of your tasks can tolerate a promise, and which need a proof.

“Local” is a property of a path, not an app

Here is the part vendors tend to blur, so let us be precise about our own product. Most serious AI apps, CSuite included, are hybrids. One interface fronts cloud models on Replicate and Runware and local models running in bundled runtimes: an Ollama server for text and one for image generation, a HuggingFace runtime for small text and speech models, and a Stable Diffusion C++ server for images and video, each listening on its own local port. The picker looks uniform. The physics behind each row is not. (How one codebase talks to all of these is its own post.)

So a sentence like “your data stays on your device” is meaningless without a qualifier. The truthful sentence names the path: generations on the local runtimes stay on the machine; generations on cloud models travel, and the provider’s policy applies. And a truthful map also names the network calls that exist even when you never touch a cloud model, because an app that claims zero traffic is either a paperweight or lying.

Three of those background calls deserve plain language. Downloading a model tells a registry which model you pulled, once. The license check sends a key and a machine identifier so paid activation works; it carries nothing you typed. The updater and price lookup ask a server for a version number and a number of dollars. All of them fail quietly when you are offline, and none of them touch prompts or outputs. That is what an honest boundary looks like: not “no network, ever,” but “no route for your content, and every other packet named.”

The map generalizes to any tool you are evaluating, which is the real reason to internalize it. When a vendor says “on-device,” ask which paths the phrase covers, then check the answer with the same switch: load the local feature, cut the network, and see what still works. A feature that quietly stops was never local. A vendor that cannot tell you which of its features would stop has not drawn its own map, and that silence is information too.

Offline has honest limits, including a clock

The airplane-mode test proves a boundary, not a lifestyle, and the boundary has real edges. The first is a clock. Licensed apps verify their license online now and then; in CSuite’s case an activation receipt stays valid for about two weeks of pure offline use before the app needs a connection to renew it, and generation pauses until it does. Your files and history stay readable regardless. If your work requires being offline for months, that is a requirement to check before you commit to any paid tool, ours included.

The second edge is capability. A 12B model on a laptop drafts, summarizes, rewrites, and answers questions well enough that many people would not notice the difference in daily work, and local image models produce genuinely usable pictures. But the frontier still lives in the cloud, the gap shows on hard reasoning and polish, and some jobs, like long high-resolution video, are cloud jobs in practice. The third edge is the setup tax: weights must be downloaded while you are online, they occupy real disk space, and your RAM sets a hard ceiling on what runs at all.

None of these edges weaken the proof. They scope it. Local AI is not the better tool for everything; it is the only tool for the subset of work where the material cannot travel, and the airplane-mode test is how you confirm that subset is actually covered.

Sort your work by what a leak would cost

The practical takeaway is a sorting rule, not a side to pick. Look at each AI task and ask what it would cost you if the prompt and output appeared on someone else’s server. For blog drafts, moodboards, and code you plan to open-source anyway, the answer is nothing; use whichever model is best, wherever it runs. For the contract, the diagnosis, the unreleased design, route the work down a local path, and run the airplane-mode test once so the guarantee is something you observed rather than something you were told, by anyone. Including us.

The test itself is worth running once per machine and once per app, the way you would test a backup by actually restoring it. It costs five minutes, it needs no expertise, and it converts the vaguest word in this industry, “private,” into something you watched happen with the radio off.

A privacy policy tells you what a company intends. A dead network interface tells you what is possible. For the work that matters most, buy your guarantees in physics, not prose.

Disclaimer: This is general information, not legal advice. Tool licenses, content-usage rights, and platform policies summarized here change frequently and reflect sources available as of September 2026. Verify the current terms of each tool and the rules of each platform or marketplace before publishing commercial work, and consult counsel where real money or rights are at stake.