The Best Privacy Feature Is Invisible

Privacy settings are where good intentions go to become homework.

Most users do not want to configure retention windows, training opt-outs, gallery visibility, signed URL expiry, support access, prompt history, and provider routing before generating an image. They want to use the tool and not regret it later.

The best privacy feature is the one that works before the user knows what to ask. No training by default. No public gallery by default. No prompt history by default for sensitive workflows. Short-lived uploads by default. Private outputs by default. Deletion that actually reaches storage, links, and derivatives.

This is not paternalism. It is product design. We do this everywhere. Good payment products do not ask users to understand tokenisation before checkout. Good password managers do not ask users to design entropy. Good elevators do not ask users whether the doors should close before moving.

AI image tools ask for rich personal data. That means the default matters more than the setting. A buried privacy toggle is not a strong promise if the first upload already created a durable record.

Configurability still has a place. Teams may need saved projects, audit trails, shared galleries, or enterprise retention. But those should be deliberate modes, not accidental defaults for every person editing a photo or testing a campaign concept.

The copy also gets better when defaults are private. Instead of saying, “You can adjust your privacy settings,” the product can say, “Uploads are private by default and deleted after generation.” One sentence. Human-scale. No treasure hunt.

Users should not need to become mini compliance officers to make images. If privacy requires configuration, the product has already pushed risk onto the person least equipped to evaluate it.

Further reading: The privacy promise users actually understand, The minimum privacy standard for AI image apps, and Private by default is a product decision.