To use AI privately, cover four separate things: what you say, how you connect, who you are and how you pay. No single tool covers all four. An AI service that can't read your chats protects the first, a VPN protects the second, and an email alias and a non-card payment handle the last two. This guide shows what each one does, where it stops and how to combine them.
Most advice on this topic stops at settings: turn off training, use a temporary chat, don't paste secrets. Those steps help, but they leave the structure alone. The company still receives your words in a form it can read, from an IP address it can see, under an account with your email and card on it.
What does it take to use AI privately?
It takes a decision about four layers, because each one reveals something different and is covered by a different tool. What you say is the layer most people mean by "private AI." The other three are about the connection and the account around the chat: where you connect from, the email you signed up with and the card you paid with.
| Layer | What it reveals | What covers it |
|---|---|---|
| What you say | Your prompts, files and replies | An AI service that can't read your chats, or a model on your own computer |
| How you connect | Your IP address and rough location | A VPN |
| Who you are | Your email address | An email alias, or an account with no email |
| How you pay | Your name and card details | Bitcoin or another non-card payment |
The layers are independent. Covering one tells you nothing about the others, which is why "is this AI private?" rarely has a one-word answer. A better question is which layer a given tool covers.
What can an AI service read in your chats?
On most consumer AI services, everything you type reaches the provider in a form the provider can read. Its policies then decide who can review a chat, how long it is kept and whether it trains future models. Privacy settings change how those policies apply to you. They don't change who holds a readable copy.
There are two ways to change that. One is to run a model on your own computer, so nothing leaves it; Privacy Guides recommends this route, and the cost is hardware and smaller models.1 The other is a hosted service built so that its operator can't read what passes through it.
Maple takes the second route. Your chats are encrypted on your device and decrypted only inside a hardware-isolated enclave running open-source code, and a live attestation lets you check that the running code matches what we publish.2 Our proof page walks through how to verify it.
I think it's worth being exact about where that promise ends, because the rest of this guide starts there. Maple protects the contents of your chats. Where you connect from, which email you use and how you pay are the other three layers, and those are yours to decide.
Does a VPN make ChatGPT or other AI chats private?
No. A VPN hides your IP address from the AI service, and it hides which service you're using from your internet provider. It does nothing to the chat itself: your prompts still arrive in a form the provider can read, under the account you're signed in to. A VPN covers the connection layer and only that layer.
Proton, which sells a VPN, says so plainly in its own guide: "A VPN can’t change how OpenAI collects, retains, reviews, or uses the information you provide."3
The reverse holds too. An AI service that can't read your chats still sees where the connection comes from, as every web service does. Anthropic's privacy policy lists "IP address (including information about the location of the device derived from your IP address)" among what it collects automatically.4
Maple's server code does not record your IP address, and the code is open source, so you can check that for yourself.5 The network in front of any web service still sees where a connection comes from, and ours is no exception. You don't have to take our word on this layer: use a VPN, and the address that arrives is the VPN's.
The two tools are complements, not substitutes. Used together, the AI service can't read what you say and doesn't receive your home IP address.
How do you hide your IP address from an AI service?
Turn on a VPN before you open the app. The AI service then sees the VPN's address in place of yours. That matters because an IP address places you in a rough location and on a particular network, and because it is the same across everything you do from that connection.
A VPN moves trust; it doesn't remove it. With a traditional VPN, one company sees both who you are and what you do. Carl Dong, writing on Obscura's blog, describes what users are left with as a "pinky-promise that none of their data is logged."6
Obscura is the VPN we point Maple users to, because its design answers that problem. Obscura calls it a two-party VPN: its own servers relay your connection, and independent exit servers run by Mullvad connect you to the internet.7 By Obscura's description, its servers see your IP address but can never decrypt your traffic, and the exit servers never see who you are.
This splits “who you are” from “what you do”, meaning neither party can tie your identity to your browsing.
The app's source code is public and licensed under GPLv3. An audit by Cure53, published in December 2025 and covering the macOS app, network extension and protocol, found "no major security vulnerabilities" within its defined threat model.8 Obscura costs $8 a month and takes a card, Bitcoin over Lightning or Monero (checked 11 October 2026).
Keep one limit in mind. A VPN hides where you connect from, not who is signed in. If you log in to the same account, the service knows it is the same account.
How do you keep your real email address out of an AI account?
Sign up with an alias. An alias is a forwarding address that delivers to your real inbox and can be switched off if it leaks or starts attracting spam. Your real address never enters the AI service's database, so a breach or a mailing list there can't be tied back to your main inbox.
addy.io is an open-source service that does this, with a free plan.9 You give each site its own alias, each one forwards to your real inbox, and you can deactivate any of them from your dashboard.
An alias gives you separation, not anonymity: it is still one stable address tied to one account. What it buys you is that the address leads nowhere else.
Some services let you skip email altogether. Maple has a sign-up option with no email: you get an Account ID and set a password. The trade-offs are real, and the app makes you acknowledge each one first.
- You pay for a full year in Bitcoin or redeem a subscription pass. There is no card payment, no monthly plan and no free trial.
- There is no support for these accounts.
- The Account ID is shown once. If you lose it, the account is gone, and we can't recover it.
We don't claim anonymity. We claim we can't read your chats.
How do you pay for AI without a card?
Pay with Bitcoin where the service accepts it. A card payment sends your name and billing details to a payment processor and ties them to your account. A Bitcoin payment carries neither. Maple accepts Bitcoin on yearly plans, and you choose it at checkout.
Bitcoin is not private by default. Payments made on the main chain are public records, so how private yours is depends on how you got the coins and how you send them. Lightning and Monero are other options some services take; Obscura accepts both.
For most people this is the layer that matters least and costs the most effort. If your card and your email are already on the account, paying another way adds little. It earns its place when you have chosen the no-email route.
Which setup is right for you?
Choose by which layers matter to you, not by how many you can stack. Most people are well served by the first setup below, because what you say is where your health, money, work and private thinking live. Each step after that adds a layer and costs some convenience.
| Setup | What you use | What it covers |
|---|---|---|
| Everyday | An AI service that can't read your chats, with your usual email and card | What you say |
| More separation | The same, plus a VPN and an email alias | What you say, how you connect and your main email |
| Most separation | A VPN, an account with no email and Bitcoin | All four layers, with no support and no account recovery |
None of this is about hiding. Eric Hughes drew the line in 1993: "Privacy is not secrecy," he wrote, and "Privacy is the power to selectively reveal oneself to the world."10
Deciding what each company learns about you is ordinary self-determination. Some people do it on principle and some because they enjoy doing it properly. Both are good reasons.
What do these tools not fix?
They don't fix what you choose to put in. If you type your full name and address into a prompt, they are in the prompt, and what protects them is the first layer and nothing else. The tools also can't help with a compromised device, or with other services you connect to an assistant and the data those services hold.
If you want no server involved at all, run a model on your own computer.1 You give up the larger models and take on the hardware, and for some work that trade is right.
Privacy tools also don't replace professional duties. If you handle client or patient information, our guide for therapists shows how those rules sit on top of everything here.
For everything else, decide which of the four layers matter to you, cover those and get on with the work. If you want to start with the first one, our getting-started guide takes a few minutes.
Sources
- Privacy Guides, AI Chat, updated May 24, 2026; checked 11 October 2026. Recommends running models locally so data stays on the device.
- Maple, Proof: how Maple's encryption can be verified, checked 11 October 2026.
- Proton, Should you use a VPN with ChatGPT?, August 20, 2026. What a VPN does and does not protect when you use ChatGPT.
- Anthropic, Privacy Policy, effective September 10, 2026; checked 11 October 2026. Automatically collected device and connection information.
- Maple, Maple source code, checked 11 October 2026. The server, SDKs and proxy drop forwarded-address headers and have no code that records a client IP address.
- Carl Dong, Obscura, Trust, 2-Party Relays, and QUIC, February 11, 2025. The two-party design and what each hop can see.
- Obscura, Frequently asked questions, checked 11 October 2026. Exit hop operator, source code, price and payment methods.
- Obscura, Obscura's First Independent Audit by Cure53, December 16, 2025. Scope and verdict of the audit.
- addy.io, Free, Open-source Anonymous Email Forwarding, checked 11 October 2026. How aliases work, plans and source code.
- Eric Hughes, A Cypherpunk's Manifesto, March 9, 1993.
