Mobile AI privacy depends on where an app sends a request, not just where one model can run. A phone may process a task locally, send it to a cloud model, or use both paths. That route determines whether a prompt leaves the device and what privacy safeguards apply.
A local model does not make an entire app local
An on-device model runs on the phone rather than on a remote server. But an app can use a local model for some tasks and still have other network activity, or route a request to a cloud model when local processing is unavailable.
Android Developers says apps access Gemini Nano through AICore, an Android system service, and must integrate the relevant APIs to use it. Android describes AICore as having no direct internet access; internet requests, including model downloads, go through the companion Private Compute Services app. Those details describe AICore, not every app’s network behavior. Android’s Gemini Nano documentation
When Android can send a request to the cloud
Android also documents a hybrid option. If Gemini Nano is unavailable or unsupported on a device, the Firebase AI Logic Hybrid API can route a request to Gemini Flash or Gemini Pro in the cloud. So a phone’s ability to run Nano does not, by itself, show that a particular app or task stays on the device.
If keeping a specific request local matters, the practical question is whether that app uses Gemini Nano for that task and whether its chosen route can fall back to a cloud model. The model’s capabilities and the app’s implementation both matter.
What Apple says about Private Cloud Compute
Apple describes Private Cloud Compute (PCC) as a way for Apple Intelligence to handle complex requests that need larger models in the cloud. Apple says PCC uses request data to fulfill the request, deletes it after returning a response, and is designed to prevent Apple staff, including staff with administrative access, from accessing it. These are Apple’s stated safeguards. Apple’s Private Cloud Compute explanation
PCC is not end-to-end encrypted during inference. End-to-end encryption means that only the communicating endpoints can access the unencrypted content. Apple says a cloud model must access a request in unencrypted form while computing, so that kind of encryption cannot apply during the computation itself. Apple describes other protections, including encrypted requests to validated PCC nodes and restricted execution. Encryption on the way to a server and limits on who can access data are distinct from keeping the request unreadable to the model processing it.
The useful questions to ask about a phone AI feature
Before sending sensitive information to an AI feature, focus on the particular app and task: does it process the request on-device, can it switch to a cloud model, and what does the service say about handling request data? A local model is one part of the route; the app’s implementation determines how that capability is used.
