We read the terms, privacy policies, and help-center pages of eight hosted-AI services, archived every page we relied on, and recorded — with no scoring and no ranking — what each provider’s own words attach to a user’s identity and what they say happens to prompts. The full table is the KYC Drift hosted-AI matrix; this note is the first read of what it shows.
The spread is wide — wider than the products suggest#
Eight services that look interchangeable in a browser tab describe, in their own documents, radically different identity postures:
- Venice no-account demo; wallet login possible; states it does not retain prompts and imposes zero-data-retention downstream 5/17 dimensions assessed
- OpenRouter account required; email 'may be required'; crypto accepted; prompts go to the model provider you select — downstream retention/training varies, non-training models selectable 6/17 dimensions assessed
- ChatGPT email OR phone OR SSO to register; training on by default with opt-out; deleted accounts may re-register with the same phone number 6/17 dimensions assessed
- Le Chat email-anchored account; phone only if you provide it; age 13+; free-tier training on by default with an explicit opt-out (paid excluded); chats kept until you delete them; identity data retained 1-5 years after account deletion 10/17 dimensions assessed
- Perplexity name + contact info at signup; email content excluded from training — chat/search training not disclosed (thin coverage: read with care) 2/17 dimensions assessed
- DeepSeek email-or-phone signup; data controller registered in China; training on by default with no stated opt-out; retention 'as long as necessary' 6/17 dimensions assessed
- Claude SMS phone verification for all new users with no skip, VoIP rejected, one account per number; training on by default with opt-out; deleted conversations removed from back-end within 30 days 8/17 dimensions assessed
- Gemini Google Account required (ties use to the parent-company profile); human review of some chats; human-reviewed chats retained up to 3 years; temporary chats excluded from review-based improvement 6/17 dimensions assessed
The two ends barely inhabit the same category. At one end, Venice states that a demo works with no account at all, that an account — if you want one — can be created with a Web3 wallet login, that it does not retain prompts or outputs, and that its stated zero-data-retention policy bars its downstream model providers from retaining them either. At the other, Gemini requires a Google Account — activity is stored with that account and treated as personal information under Google’s own policy — states that human reviewers read some conversations, and that human-reviewed chats are kept up to three years, surviving even activity deletion.
Between the ends, the differences are not gradations of the same thing but different kinds of coupling: DeepSeek’s most consequential fact is jurisdictional (a data controller registered in China, with training on by default and no stated opt-out); Claude’s is a hard phone anchor; OpenRouter’s is architectural (your prompts’ fate depends on which downstream model you pick); Le Chat’s is EU regulatory posture made visible — a French data controller, a 13+ age floor against Claude’s 18+, an explicit training opt-out control with paid tiers excluded by default, and an unusually candid disclosure that identity data survives account deletion by one to five years.
Three contrasts worth your attention#
The phone number is where policies diverge hardest. Anthropic’s help center states SMS phone verification applies to all new users, cannot be skipped, rejects VoIP, Google Voice, app-generated numbers and landlines, and binds one number to one account. OpenAI’s help center describes the opposite posture for ChatGPT: email or phone or SSO as the identifier, and — with some exceptions — a deleted account may re-register with the same phone number. Same product category, opposite anchoring: for Claude the number is a durable identity anchor; for ChatGPT it is a reusable contact point. (A third-party report claims Google-SSO signups skip Claude’s phone step; the official statement says otherwise, and the service page records that conflict rather than resolving it.)
Retention is where “delete” means five different things. Venice states it does not retain prompts at all. Claude and ChatGPT both state deleted data leaves their systems within 30 days. Mistral states chats stay until you delete them — and, with unusual candor, that account data then lingers one more year and civil-identity data five. Gemini states deleted activity is gone unless a human reviewer saw it — then it lives up to three years, disconnected from your ability to remove it. DeepSeek states you can delete chat history, and keeps the retention period itself at “as long as necessary.” Five policies, one word — “deletion” — and the only way to know which one you are getting is the paperwork.
Routers split the identity question in two. OpenRouter and Venice both forward prompts to downstream model providers — a two-hop trust structure the direct providers do not have. They resolve it in opposite directions: OpenRouter states downstream retention and training vary by provider and lets you select models whose providers commit not to train on your data; Venice states it imposes zero-data-retention on all of its model providers. Both are provider statements, not verified enforcement — but they are opposite architectures of responsibility, visible only in the documents.
What this table refuses to tell you#
It will not tell you which AI is “anonymous” — none of these facts measure your network layer, your payment trail, or what legal process can reach. It will not rank the eight — a phone requirement is noise in one threat model and disqualifying in another. And it will not fill gaps with vibes: where we have not yet extracted a dimension, the cell says not assessed, because a blank cell that readers interpret as “no requirement” is how comparison tables lie without technically lying. Coverage per service is printed on the figure above for the same reason.
Everything here is provider-stated, dated, and linked to an archived copy — and all of it drifts. Claude’s phone requirement did not exist for accounts created before roughly late 2024; ChatGPT’s phone-only signup path exists today in a specific list of thirteen regions and nowhere else. That is the dataset’s actual thesis: these are not fixed properties of products, they are policies in motion, and the honest way to compare them is to keep receipts over time. The matrix will do exactly that, on a monthly cycle.
Corrections, disputes, missing services: methodology explains the rules; editor@cypherpunkguide.com reaches a human who fixes errors in public.