DeepSeek Privacy and User Rights: The Good, The Bad, and The Concerns

DeepSeek… How much do you really know about what’s happening behind the scenes with your data? From privacy practices to user rights, I’ve taken a closer look at their policies to help you navigate their terms with open eyes. Let’s break down the good, the concerning, and everything you need to know before diving into their services.

With all the hype around DeepSeek’s Reasoning and their capabilities, I figured I’d give their privacy policy and terms of service a deeper look. Here’s a breakdown of the important points I found in their Privacy Policy, and Terms of Service:

1. Data Transparency:
   They’re very clear about how they collect data. They categorize it into three groups:

• Information You Provide:
• Profile details like your name, email, username, date of birth (if applicable), and password;
• User inputs, including text, audio, prompts, uploaded files, chat history, and feedback;
• Contact details, such as proof of identity or inquiries about term violations, are shared when you contact their team.
• Automatically Collected Information:
• Device details like your model, operating system, IP address, and keystroke patterns;
• Usage data, such as the features you use or actions taken within the service;
• Cookies and similar tools that track behavior for analytics and improve your experience.
• Information from Other Sources:
• Data from linked accounts (e.g., Google, Apple) or advertising partners who share your activity across apps, websites, or physical stores.

2. Usage Transparency:
They acknowledge reviewing your inputs and outputs to improve services. While they promise encryption and de-identification, there’s little detail about obtaining consent for these reviews.

3. Cookie Management:
They allow users to manage cookies through browser settings. Still, the process requires manual adjustments, which could be tricky for non-technical users.

4. Data Storage:
Here’s where it gets tricky:

• They store data in China, and while they promise to follow applicable laws, this raises concerns for users in stricter jurisdictions like the EU or the US.
• Data retention is vaguely described as “for as long as necessary.”

5. Security Measures:
They claim to implement “commercially reasonable” safeguards but don’t promise perfection. They’re transparent about risks, including:

• No Guarantee of Full Security: They admit internet transmissions and emails aren’t 100% secure.
• Circumvention Risks: Privacy settings and security measures could potentially be bypassed by unauthorized parties.
• User Responsibility: They emphasize that users must safeguard their accounts, passwords, and credentials.

6. User Rights and Responsibilities:
DeepSeek recognizes users’ rights in the following categories.

• Accessing, correcting, or deleting your data.
• Withdrawing consent or limiting how your data is used.
• Contacting them directly to exercise these rights.

But they put all the responsibility on the users. You must safeguard your accounts and avoid creating offensive or harmful content. Misuse, in their view, can lead to account termination without prior notice.

7. Intellectual Property
They’re clear on ownership:

• Users retain rights to inputs and outputs.
• DeepSeek owns the models, technology, and underlying systems.
• Outputs can be used for personal, academic, or derivative works (suggesting commercial use is likely allowed, even if not explicitly stated).

8. Updates:
They promise to inform users of policy changes through an updated “Last Updated” date or direct notifications.

9. Dispute Resolution:
All disputes are governed by Chinese law and handled in Chinese courts, which may be a barrier for international users unfamiliar with the system.

10. Generative AI Disclaimer:
Outputs are not guaranteed to be accurate, and users are fully responsible for verifying results and managing any risks from reliance on AI-generated content.

Concerns and Red Flags that I see, as far as I understand:#

While their policies have strengths, like transparency in data collection and acknowledgment of user rights, they also raise some red flags:

1. No GDPR or CCPA Mention: They don’t explicitly claim compliance with GDPR or CCPA. While they grant users rights like data access and deletion, this lack of alignment is concerning for anyone prioritizing privacy.

2. Data Storage in China: This raises red flags for international users due to the potential for government surveillance and weak privacy protections.

3. Broad Data Collection: They collect extensive info, including keystroke patterns, device IDs, and activity on third-party apps/websites, with little clarity on how user consent is obtained.

4. Input Reviews: User inputs and outputs are reviewed to improve services, but the process isn’t transparent.

5. Data Retention Ambiguity: Their retention policy is vague (“as long as necessary”), which may lead to excessive data retention. Even after account deletion, they may retain data under certain scenarios.

6. Liability on Users: Users bear full responsibility for verifying outputs, even when using the AI for critical advice like medical or financial matters.

Conclusions, and My Takeaways:#

DeepSeek has a well-organized policy with commendable transparency, but there are weaknesses hard to ignore:

• Data Sovereignty: Storing data in China raises privacy and compliance concerns.
• Broad Data Sharing: Sharing user data with third parties leaves users with little control.
• Limited Accountability: Users are responsible for outputs and account security.

Personally, I am cautious about companies that are not headquarted in EU, and even don’t comply with GDPR. No matter how good faith, it’s a strong indicator of their ability to uphold user’s privacy. Even the US is not a good place for user’s privacy. And their servers’ location in China makes me even more hesitant.

That said, I definitely would try their services. But I’ll do so in a Mozilla Firefox containerized environment with a secure VPN or proxy server.