Quick answer: DeepSeek is two different things with two opposite privacy stories. The DeepSeek app and API send your text to servers in China, where the privacy policy says inputs can be stored and used to train the model, which is why regulators from Italy to South Korea have restricted it. The open-weight DeepSeek models you download and run yourself are just files, MIT-licensed, and when you run them locally nothing you type ever leaves your machine.

Almost every “is DeepSeek safe?” article gets this wrong by answering as if DeepSeek were one product. It is not. The confusion is the whole story, so start there.

The one distinction that changes everything

When a headline says “DeepSeek,” it can mean either of two things:

  1. The hosted service. The mobile app, the website at chat.deepseek.com, and the paid API. You type, your text travels over the internet to DeepSeek’s servers, and a model there answers. This is what regulators banned.
  2. The open-weight models. DeepSeek publishes the actual model weights (R1, V3, and the distilled variants) as downloadable files under an MIT license. You can run them on your own hardware with no DeepSeek account and no connection to China.

These share a brand and nothing else that matters for privacy. Judging the downloadable model by the app’s data practices is like refusing to read a book because you distrust the bookstore’s loyalty-card program. Keep the two separate for the rest of this page.

What the DeepSeek app and API actually collect

DeepSeek’s own privacy policy is blunt about where your data goes. The company collects, processes and stores personal data in the People’s Republic of China, and the text you type is part of that. Independent write-ups of the policy note that user inputs, including personal and commercially sensitive information, can be stored and used to improve the service, which in practice means training future models unless you opt out, and shared within its corporate group.

The location is not a trivia point. Under China’s National Intelligence Law, a China-based company can be compelled to cooperate with government data requests quietly and without outside oversight. So the honest risk model for the app has two layers: DeepSeek itself keeps and may train on your text, and a third party with legal authority in China can reach that text. This is the same category of concern that applies to any cloud chatbot, only sharper because of the jurisdiction. The mechanics of storage, training, and human review are the same three-dial problem we break down in does ChatGPT train on your chats. DeepSeek just sets every dial toward maximum collection.

The regulators agreed: a wave of restrictions

This is not a hypothetical worry that privacy writers invented. Governments looked at the same policy and acted.

Italy moved first and hardest. On January 30, 2025, the Italian data protection authority, the Garante, imposed an immediate block on DeepSeek after the company’s answers about what data it collects, from which sources, and whether it is stored in China were judged completely insufficient. Notably, the entities behind DeepSeek argued that European law did not apply to them, which is not the answer a privacy-respecting service gives.

Other governments followed with narrower actions, mostly aimed at official devices rather than the public:

  • South Korea removed DeepSeek from local app stores pending a review of its data handling.
  • Australia, Taiwan, and the Czech Republic (the latter in July 2025) banned it across government systems.
  • In the United States, Texas restricted it broadly for state use, Virginia and New York limited it on government devices, and federal bodies including NASA and the US Navy prohibited it over data concerns.
  • Ireland and Belgium opened their own investigations.

The pattern is consistent: when regulators asked DeepSeek the app where the data goes, they did not get an answer they could live with. That is your answer too.

The security incidents made it worse

Beyond policy, DeepSeek had a basic security failure. Researchers found an exposed ClickHouse database left publicly accessible with no authentication, which allowed anyone who found it to query sensitive backend data including chat logs and API secrets. A privacy policy tells you what a company intends to do with your data. An open database tells you what actually happened to it. Both point the same direction for the hosted service.

The part almost nobody explains: the weights are free, and local

Here is the payoff, and it flips the whole conversation. The models that made DeepSeek famous are open-weight. DeepSeek R1 was released in January 2025 as the first open-weight model to rival the top closed reasoning models on math, code, and science, and it ships under the MIT license, which permits commercial use, modification, and self-hosting. The weights are published on Ollama and Hugging Face, alongside a range of distilled versions in 1.5B, 7B, 8B, 14B, 32B, and 70B sizes plus the full 671B model.

Run one of these locally and every privacy problem above evaporates, not because DeepSeek promised to behave, but because there is no longer a server involved:

# install Ollama (Linux/macOS)
curl -fsSL https://ollama.com/install.sh | sh

# download and run a DeepSeek model entirely on your machine
ollama run deepseek-r1:8b

Once the weights are on your disk, the model is a file that does math. It has no account, no telemetry, and no way to send your conversation to China or anyone else, because it makes no network calls at all. You can prove it the crude way: disconnect from the internet and it keeps answering. The National Intelligence Law is irrelevant to a set of numbers sitting on your SSD. This is why “is DeepSeek safe?” has no single answer. The app is a privacy problem; the local model is one of the strongest privacy positions available, and it happens to be free.

The trade is the usual one for local AI. You need a capable GPU, the smaller distilled models are not as sharp as the full 671B version, and you do the setup yourself. If that trade appeals to you, our how to run AI locally guide walks the full path, and best uncensored local AI models covers the field beyond DeepSeek. For the broader argument, ChatGPT vs local AI privacy lays out why local is a physics guarantee rather than a policy promise.

So, is DeepSeek safe?

Split the question and it answers itself. The DeepSeek app and API are not safe for anything you would not want stored in China and possibly used for training. Treat them like a public forum: fine for casual questions, wrong for anything personal, legal, medical, or commercial. The open-weight DeepSeek models running on your own machine are safe in the strongest sense, because the data never leaves you.

If you want the strongest privacy and you do own an NVIDIA card, you do not have to assemble the stack yourself. Ember packages it for companion chat: the model runs on your card, and there is no account or email either, paid once in crypto, so the privacy story is local execution and anonymity.

The name on the label is not the answer. The address the data travels to is. For the full framework, see the AI data privacy guide and private ChatGPT alternative with no data collection.