DeepSeek AI collects keystroke data and more, storing it in Chinese servers

U.S. tech companies are known to stockpile as much user data as they can, but DeepSeek’s privacy policy makes Meta, Google, and OpenAI look tame. 

Over the past few days, China-based AI startup DeepSeek has catapulted into tech consciousness with an open-source model that many claim is just as good, if not better, than OpenAI models and API costs for a fraction of the price. DeepSeek R1 might be significantly cheaper to run, but your privacy and security are the actual cost.

Looking through the fine print of DeepSeek’s Privacy Policy, numerous red flags worth examining before you sign up.

DeepSeek’s collected data is subject to local Chinese laws

“The personal information we collect from you may be stored on a server located outside of the country where you live. We store the information we collect in secure servers located in the People’s Republic of China,” the privacy policy reads.

In another section about how DeepSeek shares user data, the company states that it may share user information to “comply with applicable law, legal process, or government requests.”

Tweet may have been deleted

As with the ongoing TikTok ban — initially enacted due to concerns about privacy, national security, surveillance, and propaganda — DeepSeek’s privacy policy raises concerns about a U.S. foreign adversary’s ability to access U.S. user data. Users are familiar with the massive amounts of data U.S. tech companies collect, but China’s cybersecurity laws make it much easier for the government to demand data from its tech companies. Additionally, DeepSeek users have reported instances of censorship, when it comes to criticizing the Chinese government or asking about Tiananmen Square.

Tweet may have been deleted

DeepSeek collects extensive data, including keystrokes

Not only does DeepSeek collect “text or audio input, prompt, uploaded files, feedback, chat history, or other content that [the user] provide[s] to our model and Services,” but it also collects information from your device, including “device model, operating system, keystroke patterns or rhythms, IP address, and system language.”

Tweet may have been deleted

Companies with AI models like Google, Meta, and OpenAI collect similar troves of information, but their privacy policies do not mention collecting keystrokes. There’s also the added issue that DeepSeek sends your user data straight to Chinese servers.

Tweet may have been deleted

DeepSeek retains user information for as long as they want

DeepSeek’s privacy policy states that the company retains user information “for as long as necessary to provide our Services and for the other purposes set out in this Privacy Policy.” 

For context, Google Gemini could can retain your data for up to three years, so, not great. OpenAI saves your deleted data for 30 days or 90 days for Operator. However, Meta also has an indefinite data retention period in the U.S.

If knowing that Meta saves your data indefinitely makes you uneasy, DeepSeek’s policy is even more of a cybersecurity red flag because of China’s governmental authority over its private sector. An undefined retention period exposes user data to even more risk to security breaches.

Other DeepSeek privacy and security questions left unanswered

In DeepSeek’s privacy policy, there’s no mention of the security of its servers. There’s nothing about whether data is encrypted, either stored or in transmission, and zero information about safeguards to prevent unauthorized access.

DeepSeek also doesn’t say whether users can opt out of sharing their data to train its models. Although Google and Meta have this in common with the LLM, which is to say it’s not completely unfounded, it’s always worth mentioning: Whatever you share with the chatbot, you share with the internet — and maybe the Chinese government in this instance.

Mashable has reached out to DeepSeek for further clarification about its policies and will update this story with a response.