AI workspace privacy: a founder's data flow guide.

Updated 2026-04-27 · 12 min read

I'm going to walk through where your data actually goes when you use an AI workspace tool. Not the marketing version. The technical version, with the specific terms of service that govern each path.

Most founders I talk to are vaguely uncomfortable with putting their pitch decks and customer interview notes into ChatGPT, but haven't read the terms closely enough to know what's actually true. So they either trust the marketing language ("we don't sell your data") or they don't use AI on the sensitive work at all, which means they leave a lot of value on the table. There's a better posture, and it starts with knowing the actual data flow.

What's in your AI workspace, really

Before talking about where the data goes, take stock of what's actually in there. For an indie founder, an AI workspace typically holds:

• Strategic documents. Pitch deck drafts, business plan, lean canvas, vision and mission statements.
• Financial models. Revenue projections, burn rate, pricing experiments, scenario plans.
• Customer data. Interview transcripts, persona docs, support tickets, win/loss notes. This often contains real names, emails, and quotes from people who didn't consent to having them processed by an AI.
• Hiring and team material. Job descriptions, interview rubrics, candidate notes, performance review drafts.
• Investor material. Updates, board prep, cap table thinking, fundraising correspondence.
• Personal reflection. Weekly review notes, hard-month emails to mentors, drafts of difficult conversations.

Most of this is more sensitive than the email you're encrypting and the password manager you're paying for. Yet the privacy posture for AI workspaces is often weaker than either. Closing that gap is what this page is about.

The three postures

Every AI workspace falls into one of three categories. Knowing which category you're using is the first move.

Posture 1: Cloud workspace with bundled AI

Examples: Notion AI, ChatGPT Plus, Claude.ai Pro, Reflect, Mem.ai, Tana.

Data flow:

1. You type a message into the web or desktop app
2. The app sends it to the workspace company's servers
3. The workspace company stores it in their database
4. The workspace company forwards it to an AI provider (OpenAI, Anthropic, or their own model)
5. The response comes back through the workspace company
6. The workspace company logs both, then shows you the response

Who has a copy: the workspace company, the AI provider, you. Three parties.

Who can see your prompt: workspace company employees with access (typically gated by SOC 2 controls), AI provider employees with access (similar), and anyone the workspace company sells to or shares with under their TOS.

What changes if you cancel: data deletion is governed by the workspace company's retention policy. Notion retains data for 30 days post-deletion; other tools vary.

Posture 2: Local-first desktop tool with BYOK

Examples: Projelli, Cursor (with BYOK), Continue.dev, Obsidian + AI plugins.

Data flow:

1. You type a message into the desktop app
2. The app reads your API key from your OS keychain
3. The app sends the message directly to the AI provider's API endpoint, using your key
4. The AI provider processes the request
5. The response comes back to your machine
6. The app writes the conversation to a file on your hard drive in a folder you chose

Who has a copy: you (the file on your machine) and the AI provider (in their API logs). Two parties.

Who can see your prompt: you and the AI provider. The desktop app's company is not in the path. There are no app-company servers seeing your data.

What changes if you cancel: nothing. Your files are on your machine, in Markdown. The desktop app uninstalling doesn't delete your data; you'd have to delete the folder yourself.

Posture 3: Fully local AI

Examples: Ollama running Llama 3 or Mistral; LM Studio with any open-weight model; Projelli with the Ollama provider configured.

Data flow:

1. You type a message into the desktop app
2. The app sends it to the local model running on your machine (typically on localhost:11434 for Ollama)
3. The model generates a response, on your machine
4. The response comes back to the app
5. The app writes it to a file on your hard drive

Who has a copy: you. One party.

Who can see your prompt: you.

This is the strictest posture. The trade-off is model quality: open-weight models in 2026 are competitive with cloud frontier models on many tasks but lag on others (long-form strategic synthesis, very long context, latest knowledge cutoffs).

What each AI provider's policy actually says

Here is the specific TOS / policy language for each provider, with the version that applies to BYOK (API tier) usage. Read these for yourself; they update.

Anthropic (Claude)

• Commercial API: Anthropic does not use API inputs or outputs to train models. See Commercial Terms of Service.
• Logging: Anthropic retains API logs to monitor for abuse, with limited retention windows.
• Consumer Claude.ai: Different terms. May use opted-in data per the consumer Privacy Policy.
• Subpoena exposure: US-based provider, can be compelled to produce data via legal process.

OpenAI

• API: OpenAI does not train on API inputs by default. See API data usage policies.
• Logging: Default retention is 30 days for abuse monitoring; zero-retention available on request for some plans.
• Consumer ChatGPT: Different terms. Free and Plus users opt out of training in Settings → Data Controls; default may be opt-in.
• Subpoena exposure: US-based provider.

Google Gemini (via AI Studio)

• Free tier: Per Gemini API terms, Google may use prompts to improve products on the unpaid tier.
• Paid tier: Different terms; review the current version before relying on the free tier for anything sensitive.
• Subpoena exposure: US-based provider.

The bigger picture

For high-sensitivity content (anything you'd be uncomfortable seeing in a court filing), the lowest-exposure posture is local Ollama. The next-lowest is BYOK with Anthropic API. After that, BYOK with OpenAI API. Notion AI and consumer ChatGPT Plus are higher-exposure than any of those.

For lower-sensitivity content (drafting blog posts, brainstorming features, working through a stuck pitch), any of these postures is reasonable. The cost of strict privacy is convenience and sometimes quality. Pick the right posture for the actual document.

Threat models: what are you protecting against?

Privacy talk gets vague when there's no specific threat in mind. Three concrete ones for an indie founder, ranked by likelihood:

Threat 1: Vendor terms-of-service drift

The most likely threat is also the most boring. The vendor changes their data policy in a way you don't notice. They update the consumer-tier training-data clause. They get acquired. They sunset a feature. Your data was fine yesterday and is being used differently tomorrow.

Mitigation: keep the data in a posture where the vendor can't unilaterally change the rules on stuff that's already on your hard drive. Local-first BYOK accomplishes this.

Threat 2: Vendor breach

A workspace company has a security incident. Your data is among what's exfiltrated. This is rare but not unheard of (Notion, Asana, Confluence, Slack have all had incidents in the last decade).

Mitigation: the only data the workspace company has is the data you sent to them. With local-first BYOK, that's nothing. With cloud workspace, it's everything.

Threat 3: Subpoena / legal process

Less likely for most founders but real. A regulator, opposing counsel, or law enforcement requests records. Whatever the workspace company holds is potentially producible. Whatever you hold on your machine is also potentially producible, but the path is different and the protections (attorney-client privilege, fifth amendment for self-incrimination) are stronger.

Mitigation: keep workspace data local; AI provider sees only the specific text you sent for inference, not the whole archive.

The threat we are not protecting against

Determined targeted state-actor attacks. Defending against those is nation-state-grade work, beyond any consumer software. If you genuinely have that threat model (security researcher, dissident, journalist on certain beats), you need air-gapped machines and operational security beyond an "AI workspace privacy guide."

Practical privacy checklist

For a founder doing strategic work with AI in 2026, here's the working checklist:

1. Pick your AI provider's API tier (BYOK), not their consumer chatbot. Better default privacy posture.
2. Use a local-first desktop tool that keeps your conversation history on your machine. Projelli, Cursor with BYOK, Obsidian with an AI plugin. Avoid putting the working files in a cloud workspace's database.
3. Set a hard monthly cap on each AI provider's billing. Limits damage if a key leaks.
4. Encrypt the disk. Both macOS (FileVault) and Windows (BitLocker) make this trivial. If your laptop is stolen, the workspace folder is unreadable.
5. Don't store API keys in plaintext. Use the OS keychain (macOS) or an encrypted file (Windows / Linux) inside the desktop app.
6. For very sensitive content, use local Ollama. Anything that touches a draft of a thing you genuinely don't want shown later. Customer interview transcripts with names, performance review notes, fundraising correspondence.
7. Don't send PII you collected from third parties without consent. If a customer interviewee didn't agree to having their name go through an AI, redact before sending.
8. Read each provider's TOS once a year. They change. Calendar reminder, 15 minutes, done.

How Projelli implements the local-first BYOK posture

Specifically, here's what Projelli does:

• No Projelli account. No signup. No password.
• No Projelli servers in the data path. The desktop app talks directly to Anthropic / OpenAI / Google / your local Ollama. Projelli's server-side infrastructure (the marketing site, the license validator, the form handler) never sees your prompts or your files.
• API keys in OS keychain. macOS Keychain, Windows Credential Manager equivalent, Linux libsecret. Never plaintext, never in localStorage where they'd be readable by stray scripts.
• Conversations as files in your folder. Every chat saves as a `.aichat` file in the workspace folder you chose. Open with any text editor.
• Audit log on your machine. Every AI action, every file change, every workflow run is logged to an append-only file you can read or grep.
• No telemetry. Zero. The desktop app never phones home. The marketing site uses Plausible (privacy-respecting, no individual tracking).
• Update checks. The app does check for updates from GitHub Releases (signed via minisign). This is one network call to GitHub and contains no user data, only a request for the latest version manifest.

Source code is open at github.com/projelli/projelli. The full privacy policy is at /legal/privacy.

Frequently asked questions