DeepSeek V4 and privacy: what it may collect, and what not to share

Before using DeepSeek V4 with work documents, customer records or personal information, separate two questions. The sources available here do not establish that DeepSeek V4 steals data. They do show that DeepSeek can process personal data in connection with its services, and that some user-provided content may be collected .

There is also an important caveat: the sources cited here are not a standalone privacy policy written only for DeepSeek V4. DeepSeek’s broader privacy policy says it applies to personal data processed in connection with its apps, websites, software and related services that link to or reference that policy .

The short answer

Treat DeepSeek V4 like any external AI service. If you paste a password, an API key, a confidential contract or someone else’s personal information into the chat, the issue is not whether anyone steals it. You have already sent that information to an outside system that may process user content .

A good working rule is: do not enter anything you would not be comfortable sharing with an external provider.

What DeepSeek says it may collect

DeepSeek’s privacy policy covers personal data processed in connection with its services . A cited version of the policy lists specific categories that may be collected when people use the service . These include:

• Account information, such as date of birth where applicable, username where applicable, email address or phone number, and password .
• User inputs, including text input, prompts, uploaded files, feedback, chat history or other content provided to the model and services .
• Information sent when contacting DeepSeek, such as details included in support messages or proof of identity .

For everyday use, the second category is the one to watch. Your prompts, attachments and chat history can be more sensitive than your sign-up details, especially if you copy in work material, customer data, internal system information or third-party personal data.

What you should not put into DeepSeek V4

Because prompts, uploaded files, feedback and chat history may be part of the user input collected by the service , avoid sending information that is secret, regulated, hard to revoke or belongs to someone else.

Do not paste or upload:

• passwords, recovery codes, 2FA codes or session tokens;
• API keys, cloud credentials, connection strings or infrastructure secrets;
• internal documents, contracts, salary sheets, business plans or confidential material;
• bank, tax, payment card or sensitive billing information;
• medical information or health data;
• names, emails, phone numbers, addresses, identifiers or personal data belonging to other people;
• proprietary code, internal prompts, commercial strategies or trade secrets.

That does not mean DeepSeek will misuse the information. It means that once you send it, it is no longer only inside your own environment.

You are also responsible for what you submit

DeepSeek’s terms of use say users are responsible for all Inputs they submit to the services and for the corresponding Outputs. The terms also say that, by submitting Inputs, users represent that they have the necessary rights, licences and permissions to do so .

That matters in professional settings. Copying customer data, internal tickets, company documents, private code or personal information about other people into an AI tool may create privacy, compliance, contractual or internal-policy problems, even if your goal is only to get a summary, rewrite or quick fix.

Privacy controls worth checking

DeepSeek says in its document on model mechanisms and training methods that users can query basic service information, opt out of data usage for model training and delete historical data .

Still, do not assume every control works the same way everywhere. Before using DeepSeek V4 with anything even moderately sensitive, check the exact product and account you are using:

1. whether there is an option to exclude your data from model training;
2. whether that choice applies to future chats, past data or both;
3. whether you can delete chat history;
4. whether uploaded files are deleted along with the chat history;
5. whether the setting applies to the web app, mobile app, API or only part of the service.

The existence of general privacy controls is helpful, but it is not a substitute for checking the settings in the specific interface you use.

How to reduce risk in practice

The best privacy habit is minimisation: send only what the model truly needs to complete the task.

1. Anonymise before you paste

Replace names, email addresses, phone numbers, street addresses, internal IDs and company names with placeholders such as

Client A

Company B

2. Use excerpts, not full documents

If you only need help with one clause, one paragraph or one code error, extract that section. Do not upload a whole file when a small sample is enough.

3. Clean files before attaching them

Create a copy without comments, metadata, edit history, internal paths or hidden data. Do not use the original document if it contains information that is not needed for the request.

4. Separate experiments from work

Avoid mixing personal tests, work material and sensitive data in the same account unless you have a clear reason. A test account using fictional data reduces the impact of mistakes.

5. Rotate credentials if you shared them by accident

If you pasted a password, token, API key or infrastructure secret, change or revoke it as soon as possible. Deleting a chat may help with historical data if that option is available, but it should not be your only response to an exposed credential .

What to do if you already sent something sensitive

Your response should match the type of information involved:

• Password, token or API key: change, revoke or rotate it immediately.
• Personal data about someone else: document what was shared and follow your organisation’s privacy process.
• Internal or confidential document: notify security, legal or compliance teams if relevant.
• Chat history: review deletion options, since DeepSeek says users can delete historical data .
• Training use: look for the opt-out control that DeepSeek says it offers for use of data in model training .

Bottom line

There is no basis in the available sources to say that DeepSeek V4 will steal your data. There is a clear basis for a more practical warning: DeepSeek may process personal data connected with its services , and a cited privacy policy lists prompts, uploaded files, feedback and chat history as user inputs that may be collected .

Use DeepSeek V4 as you would any external AI provider. If the information is secret, personal, regulated, business-critical or difficult to revoke, do not put it in the prompt.