Someone on our Telegram asked me last week whether a certain AI provider was "private." I gave a two sentence answer, then spent the next ten minutes untangling it, because the question was hiding two completely different questions inside it.
Here is the short version. Private AI means the provider cannot read the content of your prompt. Anonymous AI means the provider cannot tell the prompt came from you. Those are separate properties. A service can give you one and none of the other, and honestly, most of them do.
If you only remember one thing from this post, remember that. Everything below is just working out the consequences.
Two axes, not one
Every AI privacy claim I have ever read collapses into two independent questions:
- Can whoever runs the model read what I sent? (content)
- Do they know it was me who sent it? (identity)
Content and identity vary independently. That is the whole trick. Most confused privacy arguments online are two people talking past each other because one is arguing about content and the other is arguing about identity, and neither says which.
Private AI lives on the content axis. The provider cannot read your plaintext, or contractually will not, or is technically prevented from doing so by hardware.
Anonymous AI lives on the identity axis. The provider might read your prompt word for word, and still have no idea whose prompt it is.
Neither one implies the other. Not even a little.
The 2x2 that sorts the entire market
Put content on one axis and identity on the other. Every real product lands somewhere in here:
| Provider can read content | Provider cannot read content | |
|---|---|---|
| Identity known | Hosted consumer chatbot | Enterprise deployment in your own cloud |
| Identity unknown | P2P inference, standard provider | TEE provider, or a local model on your machine |
Top left is where most people live. Your account is known, and every message is readable. Bottom right is the model running on your own hardware. Nobody sees the content, nobody knows you ran it.
The interesting stuff is the two off diagonal boxes. That is exactly where a product hands you one property, and it becomes very easy to assume you walked away with both.
What vendors mean when they say "private"
Almost always the content axis, and usually in the enterprise sense: we don't train on your data, retention is short, access is controlled.
That is a real guarantee. It is also completely compatible with knowing exactly who you are.
Concrete example. OpenAI retains API inputs and outputs for up to 30 days for abuse monitoring, then deletes them, and does not train on API data by default. Zero retention exists, but it is approval gated for qualifying enterprise use cases on eligible endpoints. It is all documented in their data controls guide.
Private in a meaningful sense? Sure. Anonymous in any sense? Not remotely. Every single request is tied to a billing account, and that account is tied to a human.
What "anonymous" actually buys you
An anonymous service processes your request without knowing, or being able to prove, that it came from you specifically. No account, no email, no billing row linking a prompt to a person.
Here is the part the marketing pages skip: anonymous says nothing about content. A provider serving an anonymous request can read every word. They just cannot put a name on it.
And for a lot of threat models, that is enough. A journalist protecting a source cares far more about being unlinkable than about a provider theoretically seeing the text. Someone pasting a production database schema into a chat box cares about the exact opposite.
Different risk. Different axis. Same word used to sell both.
Where they come apart in practice
- A zero retention API protects content pretty well and leaves identity fully exposed. Great if you trust the vendor but have a data handling policy to satisfy. Useless if the risk is that someone can prove you asked the question.
- An anonymous relay in front of a normal model does the reverse. Identity protected, content wide open. The relay operator or the model host still reads the prompt.
- A local model gives you both. It also costs you frontier capability. Rough math: a 70B model needs somewhere around 40GB of VRAM at 4 bit, and the strongest closed models you cannot run locally at all, at any price.
- A TEE provider goes for both over the network. Inference runs inside a hardware enclave the operator cannot read into, with cryptographic attestation instead of a pinky promise.
Now the unglamorous bit, because I would rather say it than have you find out later. If what you actually need is a signed DPA, audit logs, and a named vendor your legal team can subpoena, an anonymous network is the wrong tool. Anonymity and accountability trade against each other by design. That is not a bug someone forgot to fix.
How to test which one you are actually getting, in five minutes
Skip the landing page. Each axis has a cheap concrete test.
Content axis. Read the retention terms, not the tagline. You are looking for a number and a default. How many days are inputs kept? Does that apply to your plan or only to enterprise agreements? And critically, is "we don't train on your data" written separately from "we don't store your data"? Those are two promises. Vendors love to keep one while implying both.
Identity axis. Look at what signup demands before your first request. Email? Phone? Card? Then your prompts are linkable to you by construction, and no privacy policy fixes that. Real anonymity looks like the absence of an account. Not a nicely worded policy about the account you were forced to create.
That second test is brutal and fast. I use it constantly.
Where AntSeed sits on the map
Since I work on it, let me be specific rather than vague.
AntSeed is a peer to peer network for AI inference, so anonymity is structural instead of a policy line. No account, no signup, and requests reach providers without carrying your identity. On the map above, the default experience is bottom left: identity unknown, content readable by whichever provider serves that request.
To climb into the "content unreadable" row, the network supports TEE providers, where inference runs inside an attested enclave the operator cannot read into. Unlinkable and unreadable over the network, which is a corner that is genuinely hard to reach any other way.
If you want to poke at it, the buyer proxy is one install and speaks OpenAI and Anthropic APIs, so existing tools just point at it:
npm install -g @antseed/cli
antseed buyer start # local proxy on http://localhost:8377
export OPENAI_BASE_URL=http://localhost:8377/v1
Then Aider, Continue, Cline, opencode, or anything else that speaks those APIs works unchanged.
FAQ
What is the difference between anonymous AI and private AI?
Private AI protects the content of your prompts, meaning the provider cannot read them. Anonymous AI protects your identity, meaning the provider cannot link the prompt to you. They are independent properties and a service can offer either one alone.
Is a zero retention API anonymous?
No. Zero retention addresses content only. The request is still tied to a billing account, so the provider knows exactly who sent it.
Does running a local model give me both?
Yes, on both axes, since nothing leaves your machine. The tradeoff is capability and hardware cost. A 70B model at 4 bit needs roughly 40GB of VRAM, and frontier closed models are not available locally at all.
What is a TEE provider?
A provider that runs inference inside a hardware trusted execution environment. The operator cannot read the data being processed, and attestation proves it cryptographically rather than through a policy statement.
The takeaway
Name your risk in one sentence and the answer falls out.
"Someone could read what I asked" is the content axis. Local model, TEE provider, or at minimum a zero retention agreement.
"Someone could prove I asked it" is the identity axis. An anonymous path with no account behind it.
Both? Then you want the unreadable and unlinkable corner, and you should not settle for a product that only ships one half.
The vocabulary matters because the failure mode is silent. Nobody figures out they bought anonymity when they needed privacy... until the content leaks. At which point the distinction they skimmed past turns out to be the entire story.
Which axis does your current setup actually cover? Curious what people find when they run the signup test.
Top comments (0)