DeepSeek

Is DeepSeek safe?

DeepSeek is a capable chatbot, and the app will not damage your phone. The problem is where your words end up. Its privacy policy says it collects, processes and stores your personal data in China, and data protection authorities in Italy, South Korea and Berlin have each acted against the way it handles European and Korean users' data. In January 2025, weeks after the app launched, security researchers found one of its databases open on the internet with users' chat history inside. We score it 32/100, below ChatGPT and WeChat.

Your chats are stored in China

DeepSeek's privacy policy, last updated on 10 February 2026, names Hangzhou DeepSeek Artificial Intelligence Co., Ltd. as the company in control of your data and says plainly that it will "collect, process and store your Personal Data in People's Republic of China". That covers your prompts, uploaded files and chat history, plus device model, IP address and approximate location. The policy says chats are used to train its models; it lists a right to opt out but does not explain how in the policy itself. It also says DeepSeek does not sell personal data or use it for targeted advertising.

Apple's privacy label lists no tracking across other apps. Data linked to you includes coarse location, email and phone number, photos, audio, other content you enter and your search history. Google Play adds that the Android app may collect the list of apps installed on your phone.

Why location matters: the EU has no adequacy decision for China, so transfers need extra safeguards. In June 2025 Berlin's data protection commissioner said DeepSeek had not shown that German users' data is protected in China to an EU-equivalent level, noting that Chinese authorities have far-reaching rights to access data held by Chinese companies. She reported the app to Apple and Google under the EU Digital Services Act as illegal content. We found no sign that either store had removed it in Germany by October 2026.

The open database and other security problems

On 29 January 2025 the cloud security firm Wiz reported that it had found a publicly accessible ClickHouse database belonging to DeepSeek within minutes of looking. It required no password and held more than a million lines of log data, including chat history, API secrets and backend details. Wiz disclosed it and DeepSeek secured it promptly. Nobody knows whether anyone else found it first.

A week later the mobile security firm NowSecure published a review of the iOS app. It found that the app sent some data over the internet without encryption, used the outdated Triple DES cipher with hardcoded keys, and stored some credentials insecurely. It also found traffic going to Volcengine, the cloud arm of TikTok's owner ByteDance.

What regulators have done

Date	Authority	Action
30 January 2025	Garante (Italy)	Immediate limitation on processing Italians' data, and an investigation
By 6 February 2025	Australia, Taiwan, South Korean ministries	Bans on government devices
15 February 2025	PIPC (South Korea)	New app downloads suspended
June 2025	Berlin data protection commissioner	App reported to Apple and Google as illegal content
July 2025	Czech government	Ban across public administration

Italy acted after DeepSeek told the Garante that it did not operate in Italy and that European law did not apply to it. In South Korea, the PIPC later said DeepSeek had sent users' prompts to a Chinese cloud company without consent, according to Reuters; downloads resumed at the end of April 2025 after the company changed its practices. None of these actions came with a fine we could find.

Weak guardrails and censored answers

DeepSeek has no social feed, so the usual app risks of scammers and strangers are low. The model itself is the concern. In September 2025 the US government's Center for AI Standards and Innovation (CAISI, part of NIST) tested DeepSeek's models. Its most secure model answered 94% of overtly malicious requests when a common jailbreak was used, compared with 8% for US reference models, and echoed four times as many misleading Chinese Communist Party narratives. The test was run by a US agency and covered the models rather than the app, but the app runs the same models.

How to use DeepSeek more safely

1. Do not type anything you would not post publicly: no names, health details, work documents or passwords.
2. Do not use it on a work or government device; many employers forbid it.
3. If you want the model without the data trip to China, use a version hosted by a provider outside China, or run the open weights on your own computer.
4. Delete your chat history in the app's settings when you are done, and delete the account if you stop using it.
5. Double-check anything political or historical against other sources.

How we scored it

Privacy (25) and security (30) are the weakest factors: storage in China with no EU-equivalent safeguards, and an open database of chats in the app's first weeks. The regulatory record (30) reflects the Italian block, the Korean suspension and the Berlin notice, though none has led to a fine yet. Transparency and control (45) is DeepSeek's best factor, because you can at least delete your history and account.