Answers · a straight answer, sourced
How do I know what data an AI app sends to the cloud?
The honest way to know is for the app to show you the exact outgoing payload at the moment it makes a remote call; short of that, you are left inferring from a privacy policy or capturing the network traffic yourself — and which of those a product offers tells you most of what you need to know about it.
A privacy policy describes intent, not the bytes. To see the bytes without the product’s help, you can point it at a proxy (mitmproxy, or your browser’s network tab for a web app) and read what actually leaves — tedious, but definitive. If an app resists inspection or pins its certificates so you cannot see, treat that as an answer.
The better design puts the disclosure in the product. SovereignAI shows a customs declaration before any message goes to a remote provider: the exact system prompt, the memories and document excerpts it pulled, the prior messages, the new message, the byte and token counts, and the destination host — assembled by the same code that builds the real request, so the preview cannot lie. You approve it, or you do not, and every remote answer carries a receipt of how much left. Local endpoints never ask, because nothing leaves; no classifier decides what counts as sensitive, because that is your call, so you see everything.
This is the third of the three questions — does the product tell you at the moment, not in a document — and it is the one to ask first, because a product willing to show you an uncomfortable truth exactly when it is relevant tends to be straight with you everywhere else.
Own the answer, not just read it
SovereignAI is private AI you run yourself: local models, memory with receipts, disclosure at the moment anything leaves, and an exit you can verify. The trial is one Docker command, and deleting the volume deletes every trace of you.