What Just Happened

The Cliff Notes

DeepSeek took the world by storm and achieved breakthrough results with significantly fewer (but not exactly frugal) resources. They made it open source and free. An interesting plot twist in the global AI race while major tech companies invested billions in advanced chips, DeepSeek achieved breakthrough results without that.

The Plot Thickens

Yes, the AI model is at least on par with (and some would argue even more advanced than) OpenAI’s ChatGPT or Anthropic’s Claude. But there’s a serious catch. DeepSeek is sending user data to China which is unequivocally expressed clearly in the English-language DeepSeek privacy policy. “We store the information we collect in secure servers located in the People’s Republic of China.”

All information that you share with DeepSeek (“user input”) is stored. This is a broad category and will likely cover your chats with DeepSeek via its app or website. “We may collect your text or audio input, prompt, uploaded files, feedback, chat history, or other content that you provide to our model and Services,” the privacy policy states. However, within DeepSeek’s settings, it is “possible” to delete your chat history. Here’s the rub, while you delete your chat history – they still collected the data, sitting in China, on Chinese servers not subject to US laws. 

As outlined in the policy this is stored:

• Your DeepSeek prompt and chat history 
• Any files you upload - any files 
• Your email address 
• Your date of birth 
• Your phone number 
• Your device info 
• Your IP address  
• Any communications you have with DeepSeek 
• And the one that is potentially most concerning, keystroke patterns   

So, why is keystroke pattern concerning? What does that mean, keystroke patterns? DeepSeek captures your keystroke patterns so if I’m trying to mimic you, I have to mimic how you type on a computer.  That’s a significant RED FLAG privacy concern. Why do they need that and what is it going to be used for?   Let’s use a relatable and real-world example. DeepSeek captures the things that you type and typed before you even hit SUBMIT. It’s captured. How many times have you started writing your prompt in the prompt window, revised it and even sometimes just deleted the whole thing to start from scratch? In this example, if you start typing in the prompt window a question but deleted and never hit submit, it’s still captured by DeepSeek.  And this is keystroke capture. 

The Ripple Effect

There are a lot of inherent problems with how DeepSeek will use your data, but most concerning is even before you hit submit its stored on a server, in China, so subject to Chinese law not US law, collecting way more information you think and probably more than even that. And China has some remarkable legal requirements under its cybersecurity and privacy laws, including laws that demand tech companies cooperate with national intelligence efforts.    The difference between DeepSeek vs Claude or ChatGPT is this - DeepSeek is a black hole for your data and privacy.  Absent of international ethical use laws and frameworks, it’s figuratively and literally the wild west. Companies can, will, and are doing whatever is in their best interests.    DeepSeek is subject to government access under China’s cybersecurity laws, which mandate that companies provide access whenever the Chinese government demands it. We don’t know how many AI models are trained or how they operate, and that’s concerning, too, especially if your data could be misused or maliciously exploited. And for sure you don’t want your identity stolen or your bank account information in the wrong hands. Right?

On January 28, 2025, DeepSeek faced “large-scale malicious attacks”, which forced the company to temporarily limit new registrations. Wiz Research discovered an exposed ClickHouse database belonging to DeepSeek. The database, accessible without authentication, contained over a million log entries including chat histories, API keys, and sensitive backend data. More critically, the exposure allowed for full database control and potential privilege escalation within the DeepSeek environment, without any authentication or defense mechanism to the outside world.

Your Next Move

First, remember, not just with DeepSeek but with any similar platform, when you use their services you’re doing work for them, under the guise of them helping you. REMEMBER, they are not working for you and your use of their platform is rigged to work for them and them alone.  Second, safeguarding your data not just from DeepSeek but as well as all platforms is uber critical. Don’t be sheep and blindly provide your personal or other data wherever you go grazing from one platform to another giving them your personal life details and data. Be proactive when it comes to your digital footprint and cybersecurity. Which means, before clicking ACCEPT, actually read (with scrutiny) all terms and conditions of any platform you engage with so you clearly understand where your data is stored, how it’s being used, and who has access to it. 

Downloading the app and not reading these terms of service and just starting to use it is a very significant risk. You don’t reach number one on the AppStore by being run locally; you reach number one on the App Store by people who don’t understand what running locally means!

Here’s a very serious scenario to consider: due to DeepSeek’s ownership of output aspect being so ambiguous, what would happen if DeepSeek asserts ownership over a startup idea that came out of a DeepSeek output? It’s not clear how or where this could even be litigated, but the point here is that this could be a possibility and therefore concerning with such broad terms of service.

We don’t mean to be alarmist or assigning malice or blame or kudos, but companies are of course self-serving. Knowing that makes DeepSeek’s terms of service exceptionally concerning because it’s very, very invasive.

See below for a comparison of terms and conditions between DeepSeek and OpenAI At Fusion Collective we have a lot of problems with OpenAI’s terms and conditions, so this is by no means an endorsement. This our way to show you the level of crazy with DeepSeek vs something we already have issues with. Truthfully, there’s only so much the end user can do because without strong data privacy laws that apply to ALL companies. The onus to keeping your data safe and protecting your privacy falls squarely on you. All the risk is yours if things go sideways. So, manage your data and privacy like you own it – because you do.