Is my data safe in an AI-built app? What to ask before you type anything personal
Three questions decide it: where the app runs, where the data sits, and who can read it. A plain-words guide, with the exact questions and what good answers look like.
Leanfinit · 6 min read
You want a small app for something personal: a symptom diary, a medication list, your family budget. The tool that builds it uses AI. Is that safe? The honest answer is: it depends on three things, and none of them is about the AI itself. This guide explains each in plain words, gives you the exact question to ask, and tells you what a good answer sounds like — so you can decide in five minutes instead of giving up.
First, separate two moments: building and using
When an app is built, an AI reads your description (“a diary with date, symptom, severity”) and writes the app. Your description is text about the app — not your diary entries. When you use the app, you type the real data: “Tuesday, migraine, 7/10.” These are different moments with different risks. Most worry is about the second one, and the second one has nothing to do with AI: it is about where the finished app runs and where it keeps what you type.
Question 1 — Where does the app run?
Every app runs somewhere. Either it runs on your own phone, or it runs on a company’s server and your phone just shows the result. This is the single most important question, because an app that runs on a server has to send your entries there to work at all.
| Ask / check | Runs on your device | Runs on their server |
|---|---|---|
| Does it work in airplane mode? | Yes, fully | No, or only a cached view |
| Does it need an account to open the app? | Usually not | Almost always |
| What happens if the company closes? | The app keeps working | The app stops |
| Where is the privacy policy’s “data storage” section? | Says “on device” or “locally” | Says a region, a cloud provider or “our servers” |
The airplane-mode test is the one you can do yourself in ten seconds. Put the phone in airplane mode, open the app, add an entry. If it works, your data did not need to travel.
Question 2 — Where does the data sit?
“On device” means the entries are stored in the app on your phone, like notes or photos. “In the cloud” means they are stored on a server you do not control. Cloud has benefits — it syncs between devices and survives a lost phone — but every benefit is a copy somewhere else. For a reading log that is fine. For a symptom diary you may decide it is not.
- 1“Is there a copy of my entries anywhere other than my phone?”A good answer is a plain “no” or a precise “yes, encrypted backup in your own iCloud/Google account”. A vague “we take security seriously” is not an answer.
- 2“Can I export everything?”You should be able to get a file (CSV, PDF, text) with all entries, at any time, without contacting support.
- 3“Can I delete everything?”Deleting the app should delete the data. If there is a server, there must be a delete button that removes it there too.
Question 3 — Who can read it?
If data sits only on your device, the answer is: you, and anyone who unlocks your phone. If it sits on a server, the answer is longer: the company’s staff, their cloud provider, possibly an analytics vendor, and anyone the law in that country can compel. None of this is sinister — it is simply how servers work — but you should know which list you are on.
What about the AI reading my description?
Your description is a sentence like “a diary with date, symptom, severity and a PDF export”. Keep it that way: describe the shape of the data, never the data itself. Do not paste your real medication list into the description; add it inside the app afterwards, where it stays on the device. This one habit removes almost all the risk at the building step.
“Good description: “A symptom diary. Each entry: date, symptom from a list I can edit, severity 1–10, free notes. Show a month view and export the month as PDF. Works offline, no account.” — Bad description: the same, followed by your actual entries.”
The 5-minute check, summarised
- Airplane-mode test
- Find “storage” in the policy
- Export + delete exist?
- Describe the shape, not the data
If an app passes all four, it is safe enough for a diary, a budget or a medication list. If it fails the first one, nothing else in the policy can fix it — the data has to leave your phone for the app to work. Apps built with Leanfinit run on your device and keep entries there; that is why they pass the airplane-mode test, and why the AI never needs to see what you type after the app exists.
Describe your own app →
Takes a few sentences. Private, yours.