Does DeepSeek Store Your Data? Jurisdiction and the Policy (2026)

Yes. If you use DeepSeek's official app or website, DeepSeek stores your data, including your prompts, on servers in mainland China, according to the company's own privacy policy. But "DeepSeek" is really three distinct data paths: the consumer app, the developer API, and open weights run elsewhere. Each has a different answer.

Key takeaways

• DeepSeek's privacy policy states that collected data (prompts, uploaded files, account details) is stored on servers in the People's Republic of China, under 1 consumer policy covering the website and mobile apps.
• The policy's retention language is open-ended: data is kept for as long as necessary for the purposes it was collected, with no fixed deletion window published.
• There are 3 ways to run DeepSeek models: official app, official API, and third-party or self-hosted open weights. Each puts a different entity in charge of your prompts.
• The jurisdiction concern traces to specific statutes: China's 2017 National Intelligence Law (Article 7) obliges organizations to assist state intelligence work, while the 2021 PIPL governs domestic handling of personal data.
• Italy's Garante ordered DeepSeek to stop processing Italian users' data in early 2025, 1 of several government actions. Self-hosting open weights remains the only path where zero prompt data leaves infrastructure you control.

What does DeepSeek's privacy policy actually say?

The consumer privacy policy covering DeepSeek's website and mobile apps names a Hangzhou-based entity as the data controller and lays out broad collection categories. In plain terms, the policy says DeepSeek collects:

• Account information: email or phone number, password, profile details.
• User content: the text of your prompts, chat history, and any files you upload.
• Device and usage data: IP address, device identifiers, log data, and interaction patterns.
• Cookies and similar tracking technologies.

On storage, the policy's data-storage section states that the information collected is kept on secure servers located in the People's Republic of China. On retention, the language is open-ended: data is kept for as long as necessary to fulfill the purposes for which it was collected, rather than for a fixed number of days. On sharing, the policy permits disclosure to affiliated companies, service providers, and authorities where required by law. That is standard-shaped language, but the "required by law" clause is interpreted under Chinese law, which is the crux of the jurisdiction question below.

Two caveats matter for practitioners. First, everything above is a policy statement: it describes what DeepSeek says it does, not what an independent auditor has verified. DeepSeek has not published third-party audits of its logging or retention practices. Second, policies change; read the current text on DeepSeek's site rather than relying on any summary, including this one.

Why does the China jurisdiction matter?

The concern most security teams raise is not that an engineer in Hangzhou is reading your chats. It is that the data sits within reach of a specific legal system, and that system's rules determine who can compel access and what recourse you have.

Three statutes frame the issue:

• The 2017 National Intelligence Law. Article 7 obliges Chinese organizations and citizens to support, assist, and cooperate with national intelligence work. Read broadly, this means a China-based company can be compelled to assist state security agencies and may be barred from disclosing that assistance.
• The 2021 Personal Information Protection Law (PIPL). PIPL is a genuine privacy statute that regulates how companies collect and process personal data domestically, but it carves out state security and government functions, so it does not function as a shield against state access the way users sometimes assume.
• The Cybersecurity Law and related rules, which impose data-localization and security-review duties on operators in China.

Balance matters here. Most major jurisdictions have lawful-access mechanisms. The US CLOUD Act lets American authorities compel disclosure from US companies even for data stored abroad, and EU member states run their own surveillance regimes. The practical question is not "China bad, elsewhere good" but alignment: which legal system governs the entity holding your prompts, and does that fit your threat model and your compliance obligations? For a developer prototyping a side project, the answer may be "fine." For a company handling EU personal data under GDPR, health data, or client-confidential material, a China-based controller with open-ended retention is usually a hard stop, and regulators have said as much. Italy's Garante ordered DeepSeek to halt processing of Italian users' data in early 2025 after finding the company's responses about its data practices insufficient, and several government bodies in other countries restricted the app on official devices around the same period.

App, API, or open weights — which "DeepSeek" are you using?

This is where most coverage goes wrong: "DeepSeek" is a model family, a consumer app, and a developer platform, and the data answer differs across all three.

The official app and website

The consumer chatbot at DeepSeek's website and its mobile apps are governed by the consumer privacy policy described above: prompts, uploads, and account data stored on PRC servers, open-ended retention, China-based controller. If you paste it into the app, assume it is retained in China.

The official API

The developer platform operates under its own terms, documented on DeepSeek's API docs site, and API data-handling language is typically more limited than the consumer policy. Consumer products tend to reserve broader rights to use content for service improvement. But two things stay the same: the controller is still the China-based entity, and the jurisdiction analysis above still applies. "I use the API, not the app" changes the contract, not the legal system. For a fuller breakdown of the trade-offs, see our guide to the official DeepSeek API versus third-party providers.

Open weights on third-party infrastructure

DeepSeek releases many of its flagship models as downloadable open weights. Check the model cards on Hugging Face for the current license terms. Once weights are portable, the data question detaches from DeepSeek entirely: whoever runs the inference holds your prompts, and their policy and jurisdiction govern. That host could be a major cloud's managed endpoint, an inference aggregator, your own GPU cluster, or a decentralized inference marketplace such as Morpheus. The evaluation criteria are identical across all of them: retention window, jurisdiction, subprocessors, deletion rights. A decentralized architecture doesn't exempt a provider from those questions; you still need to know what operators can see and log. Self-hosting is the only configuration where the answer is structural rather than contractual: prompts never leave machines you control, because there is no counterparty to make a policy claim about.

How do you evaluate any AI provider's data policy?

The DeepSeek case is a useful template for reading any provider, domestic or foreign. The checklist that drives DeAI's provider trust framework comes down to seven questions:

1. Where is data stored, and which entity is the controller? Geography determines jurisdiction.
2. What is the retention window? "As long as necessary" is open-ended; a fixed number of days is enforceable-shaped.
3. Is user content used for training or service improvement, and can you opt out?
4. Who are the subprocessors and affiliates with access?
5. Is there a working deletion mechanism, and is deletion verified?
6. What legal-access regime applies, and does the provider publish transparency reports?
7. Are privacy claims audited? Zero-retention and "operators can't see prompts" are policy statements unless an independent third party has attested to them.

What should you do about it?

• Casual users: treat the official app like any service that retains everything you type in a jurisdiction you didn't choose. Don't paste sensitive personal, financial, or employer-confidential material into it.
• Developers: read the API platform terms separately from the consumer policy, and if data residency matters to your users, run the open weights through a host whose jurisdiction and retention terms you can put in a DPA.
• Enterprises and regulated teams: the official app and API will rarely survive a compliance review for regulated data. Self-hosting or a provider with suitable contractual and jurisdictional terms is the realistic path, and the open-weight releases make that path available at all.

FAQ

Does DeepSeek store your prompts?

Yes, if you use the official app or website. DeepSeek's privacy policy says it collects user inputs, including prompts and uploaded files, and stores them on servers in the People's Republic of China. That is a policy statement; DeepSeek has not published an independent audit of its logging practices.

Is DeepSeek's data storage located in China?

According to DeepSeek's consumer privacy policy, the information it collects is stored on secure servers located in the People's Republic of China. The API operates under separate developer terms, so check the platform documentation for the current data-handling language.

Can I use DeepSeek models without sending data to China?

Yes. DeepSeek releases many models as open weights, so third-party providers and your own hardware can run them. In those cases the host's privacy policy and jurisdiction, not DeepSeek's, govern your prompts. Self-hosting is the only path where data never leaves infrastructure you control.

Does the DeepSeek API have the same data policy as the app?

Not exactly. The consumer app is governed by DeepSeek's consumer privacy policy, while the API platform has its own developer terms. Both involve a China-based data controller, so the jurisdiction question applies either way. Read both documents before choosing.

Have any governments restricted DeepSeek over data concerns?

Yes. Italy's data protection authority, the Garante, ordered DeepSeek to stop processing Italian users' data in early 2025, and several government agencies elsewhere restricted the app on official devices, citing data-jurisdiction concerns.