A free AI app costs nothing to open, but whatever is typed into it can still be collected, stored, and in some cases used to train the underlying system. The Office of the Privacy Commissioner of Canada advises people to limit the personal information they share with chatbots, and U.S. Federal Trade Commission staff warned on February 13, 2024 that quietly rewriting terms to permit AI training may be unfair or deceptive. Price and data handling are separate questions, and only the app's own policy answers the second one.
Key takeaways
- "Free" describes the price. Collection, retention, and training use are set by each provider's privacy policy and settings.
- The Office of the Privacy Commissioner of Canada lists five risks of chatbot use, including training use, profiling, and unclear future use.
- Canada's privacy authorities said in December 2023 that prompts should not be retained, used for secondary purposes, or disclosed unless otherwise required.
- FTC staff said in 2024 that retroactive, quiet changes to data practices can be unfair or deceptive.
- No regulator source reviewed here rates a specific app, so no free app can be called safe on that basis.
What "free" does and does not tell you
Many AI apps offer a free tier next to paid plans. The tier changes limits such as message counts or available features, and those details change often enough that any list of current offers would be out of date quickly. What stays constant is the structure: a person types a prompt, a company processes it, and a privacy policy says what happens next. The Canadian federal guidance titled Your privacy and AI chatbots, last modified May 6, 2025, does not separate free from paid services. Its advice applies to both.
The same caution applies to claims of an "amazing" free app. An app that promises a lot at no cost is a prompt to read the policy, not a reason to skip it. No single product is assessed in this article.
The five risks the Canadian guidance names
The Office of the Privacy Commissioner of Canada (OPC) says information entered into a chatbot may be collected and stored, and that some platforms do not clearly explain how it is used, stored, or shared. It lists further risks: the information may be used to train the system further, to build profiles or make decisions about the person, to serve purposes that are unclear at the time, or to be disclosed to other users by the chatbot. Its practical advice is short. Limit the personal information shared, avoid sensitive or identifiable details, use aliases and change identifying details, consider deleting chat history if the tool allows it, review privacy settings, and never share personal information about other people or images and details of minors.
What regulators expect from developers
A second document sets expectations for the companies. In "Principles for responsible, trustworthy and privacy-protective generative AI technologies," issued on December 7, 2023, the OPC and its federal, provincial, and territorial counterparts list nine principles. Several bear directly on free apps. Organizations should be open about secondary purposes, such as using prompt data to further train a model. They should set retention schedules for training data, system prompts, and outputs. Unless otherwise required, prompts should not be retained, used for secondary purposes, or disclosed. The principles also state that public accessibility of data does not mean it can be collected or used indiscriminately, and they describe children as being at particular risk.
These are principles, not a rating. They describe what authorities want to see, and individual companies may meet them to different degrees.
The U.S. angle: changing terms after signup
In the United States, FTC staff in the Office of Technology and the Division of Privacy and Identity Protection published a post on February 13, 2024 about AI companies and their users' data. The post says it may be unfair or deceptive to adopt more permissive data practices, such as sharing data with third parties or using it for AI training, through a "surreptitious, retroactive amendment" to terms or a privacy policy. It cites an earlier FTC case from 2004 involving Gateway Learning and a 2023 genetic testing case. The point for ordinary users is that a policy read at signup can change, so the date on a policy matters.
A short checklist before relying on a free AI app
The table is an illustrative checklist built from the regulator statements above, not a scoring system.
| Question | Where to look | Reason |
|---|---|---|
| Are prompts used to train the model? | Privacy policy and account settings | The OPC lists training as a risk, and the 2023 principles ask for openness about it |
| How long are chats kept? | Privacy policy, data controls | The principles call for retention schedules for prompts and outputs |
| Can chat history be deleted? | Account settings | OPC advice is to consider deleting history if the tool allows |
| When was the policy last changed? | Policy date or change notice | The FTC warns about quiet, retroactive changes |
| Is the user a child, or is a child's information involved? | Age rules in terms | Regulators single out minors for extra protection |
| Does the prompt contain someone else's details? | The text itself | The OPC advises against sharing other people's personal information |
This article offers general information on privacy guidance. It is not legal advice, and it does not recommend or endorse any app.
FAQ
Does a free app always use chats for training?
No source reviewed here says so. Policies differ by provider and sometimes by account type, which is why the OPC and the 2023 principles ask for clear disclosure of training use.
Is deleting a chat the same as deleting the data?
Not necessarily. The OPC page speaks only of deleting chat history where the chatbot allows it, and it does not say what else a provider retains. The provider's retention policy governs that.
Which privacy rules apply to a Canadian user of a foreign app?
The answer depends on the company, where it operates, and the province. The OPC publishes the guidance referenced here, and a lawyer or the privacy authority can speak to a specific case.
Can an app change its terms after someone signs up?
Terms often allow updates, but FTC staff said that a quiet, retroactive loosening of data practices may be unfair or deceptive. Notice and the date of change are what to look for.
Related reading
- How GPT-based chatbots work
- AI learning datasets and training data
- Creative AI examples
- AI in research and discovery
More in AI Basics.
Last verified: October 2026
Sources
- Your privacy and AI chatbots, Office of the Privacy Commissioner of Canada, modified May 6, 2025
- Principles for responsible, trustworthy and privacy-protective generative AI technologies, Office of the Privacy Commissioner of Canada and provincial and territorial authorities, December 7, 2023
- AI (and other) Companies: Quietly Changing Your Terms of Service Could Be Unfair or Deceptive, Federal Trade Commission, February 13, 2024