What Is Perplexity AI, and What Happens to Your Query Once You Hit Enter

You typed something sensitive into Perplexity. A medical question, a legal one, maybe a business strategy you haven't shared with your board yet. The answer came back fast, with citations. But where did that query actually go? Who else saw it? And is any of it sitting on a server right now, training a model you didn't consent to? If you're trying to understand what is Perplexity AI at the infrastructure level, not the marketing level, this is the piece to read before you paste anything else into that search bar.

Key Takeaways

• Perplexity routes your queries to third-party model providers, meaning your prompt may travel to multiple companies' servers, each with its own retention and training policies.
• AI Data Retention is enabled by default on Free, Pro, and Max tiers. Unless you manually opt out, your queries can be used to train Perplexity's models.
• Enterprise accounts get stricter protections: no model training on your data, seven-day file retention, and contractual bars on upstream providers training on your queries.
• A class-action lawsuit filed in April 2026 alleges Perplexity shared user conversations with third parties via undisclosed trackers. These are allegations, not findings, but they highlight a gap between stated policy and verifiable architecture.
• The Sonar API applies a zero-data-retention policy for developers, a notably stricter standard than the consumer product offers by default.

What Does Perplexity Actually Do When You Search?

Perplexity describes itself as an "answer engine." You ask a question in natural language, and it returns a synthesized answer with inline citations to web sources. Under the hood, it does three things: it crawls or retrieves relevant web content, it routes your query (plus that retrieved context) to a large language model for synthesis, and it formats the response with source links. The help center confirms this pipeline. So far, standard.

The part most users miss is step two. Perplexity is not running a single proprietary model. When you use Perplexity Pro and select a specific model, your query gets sent to that model's provider. Anonyome's analysis lays this out plainly: selecting a third-party model inside Perplexity means the query travels to that outside provider, and you are now trusting multiple companies' data practices at once.

This is the architectural fact that matters most for trust decisions. You're not choosing one vendor. You're choosing a router that fans your data out to whichever upstream provider handles your selected model. Each of those providers has its own retention policy, its own training policy, its own jurisdiction.

How Many Companies See Your Prompt?

At minimum, two: Perplexity and the upstream model provider. Potentially more, depending on what Perplexity's backend does with your query for retrieval and ranking. Strac's analysis notes that everything you paste into a prompt, including uploaded files, images, and interaction history, can travel beyond Perplexity's own servers to an upstream provider under whatever terms that provider maintains.

This is not unusual for AI products that aggregate multiple models. But most users don't think about it. They see one interface and assume one company. The reality is a chain of custody, and the weakest link in that chain defines your actual privacy posture.

We run into this problem ourselves when building Selina. Any product that routes to frontier providers via API faces the same structural question: the model provider sees inference data. The honest answer is to say so plainly and let users decide. Architecture is a privacy variable, not just policy language.

Does Perplexity Train on Your Queries?

Yes, by default. Perplexity's help center states that data collection supports service functionality, account security, product improvement, and, unless a user opts out, AI model training. The toggle is called "AI Data Retention," and it is enabled by default for Free, Pro, and Max users.

This is the product decision that says the most about priorities. Opt-out means the default state is training-on. Most users never find the toggle in Account Settings. So the effective policy, for the vast majority of the user base, is: your queries train the model.

Compare this with the Sonar API's zero-data-retention policy, where prompts and responses are not stored after processing. Developers get a stricter standard than consumers. That's a deliberate choice, likely driven by enterprise procurement requirements. It tells you something about what's technically possible versus what's chosen as the default for the free and paid consumer tiers.

What Does the Enterprise Tier Do Differently?

Enterprise accounts get three concrete protections the consumer product does not offer by default. First, query information is never used to train Perplexity's own models. Second, uploaded files are retained for only seven days. Third, Perplexity's contracts with upstream model providers explicitly bar those providers from training on enterprise data.

That third point is significant. It means Perplexity can, when motivated by enterprise contracts, negotiate data-handling terms with upstream providers that restrict training. The consumer product does not appear to carry those same contractual protections.

Larger organizations can also set custom retention windows or force deletion. This is standard for enterprise SaaS, but the gap between enterprise and consumer data handling is wider here than in most products, because the consumer default is opt-in-to-training.

How Long Does Perplexity Keep Your Data?

Perplexity collects personal information, search queries, interaction history, uploaded files, and device/browser metadata. For regular accounts, personal information is kept as long as the account stays active. After account deletion, data is removed from Perplexity's servers within 30 days.

The vague part: independent reviewers have noted the policy language is imprecise about how long search queries themselves are stored, what happens to data from users who have opted out of training, and when data is truly "de-identified." The word "de-identified" does a lot of heavy lifting in privacy policies. Without a clear definition of what that means in practice, and when it happens, the commitment is harder to evaluate than it looks.

Thirty days after account deletion is a reasonable window. But the question that matters for most users is not "what happens after I leave?" It's "what's happening right now, while I'm active and haven't touched the opt-out toggle?"

What About the Comet Browser?

Perplexity launched Comet, a standalone browser, across desktop and mobile platforms between mid-2025 and early 2026. Comet can perform agentic tasks: browsing websites, completing purchases, interacting with logged-in accounts on your behalf. This expands the privacy surface considerably. The browser has access to whatever you're logged into.

Security researchers at LayerX identified a vulnerability nicknamed "CometJacking" that could potentially exfiltrate sensitive personal data to an attacker-controlled server. Perplexity initially responded that it saw no security impact.

Separately, Amazon sued Perplexity over Comet's ability to access its platform for automated shopping. The Ninth Circuit vacated the preliminary injunction in August 2026, reasoning that it's users, not Perplexity itself, who direct the browser to access Amazon's systems. The EFF supported this reasoning. The broader lawsuit remains active, and the court explicitly said its ruling doesn't set broader legal principles about agentic AI liability.

If you're evaluating Perplexity's data practices, Comet is a different risk profile than the search product. A browser that acts on your behalf inside logged-in sessions has access to credentials, payment info, and account data that a search query never touches.

What Does the Tracking Lawsuit Allege?

A class-action lawsuit filed in April 2026 alleges that Perplexity embedded tracking software that shared user conversations with third parties, including claims that entire conversations were potentially accessible along with IP addresses, device information, and browser fingerprints. The proposed class covers users from December 2022 through February 2026. The complaint also alleges that incognito mode didn't actually protect users.

These are allegations. Perplexity has stated it hadn't been served as of the reporting date. No court has made findings of fact.

But allegations like these are worth watching for a specific reason. A privacy policy is a promise. Tracking behavior embedded in code is an implementation. When those two things diverge, the code is the ground truth. This is why verifiable architecture matters more than stated policy, a point I'll come back to.

Why Did Perplexity Drop Ads?

In February 2026, Perplexity discontinued its AI-integrated advertising strategy and moved to a subscription-first model. Leadership framed it as preserving user trust in the answer engine by prioritizing objective results over ad revenue.

This is a meaningful structural change. Ad-supported models create incentive to collect more data, retain it longer, and profile users for targeting. Subscription models align revenue with user satisfaction rather than advertiser reach. The timing is notable: the ad model was dropped the same quarter the tracking lawsuit's complaint period ends.

Whether the shift was motivated by principle, legal exposure, or both is unknowable from the outside. What matters is the incentive structure. A subscription product has less reason to share your data with third parties than an ad-supported one. Less reason is not zero reason, but the structural incentive moved in the right direction.

How Should You Think About "Trusting" an AI Search Product?

There are three layers to evaluate, and most people only look at the first one.

Layer 1: Policy. What does the privacy policy say? Perplexity's privacy notice and privacy policy lay out data collection, retention, and training practices. These are legally binding but only as enforceable as the regulatory environment allows. Policies can change. They often do.

Layer 2: Defaults. What does the product do before the user changes anything? This is the actual privacy posture for 90%+ of users. In Perplexity's case, the default is AI Data Retention on, which means training on your queries. The default is what ships. Everything else is a setting most people never find.

Layer 3: Architecture. What is structurally impossible to violate? A zero-data-retention API means there's nothing to train on because nothing persists. An end-to-end encrypted channel means the operator can't read the contents even if compelled. These are constraints enforced by math and system design, not by policy documents.

The strongest trust signal is Layer 3. The weakest is Layer 1 standing alone. Perplexity's consumer product lives mostly at Layer 1 and Layer 2. The Sonar API reaches Layer 3 for retention. Enterprise contracts add contractual bars (still Layer 1, but with legal teeth and shorter retention).

What's the Right Question to Ask About Any AI Product's Privacy?

It's not "do you have a privacy policy?" Every product does. It's not even "what does your privacy policy say?" because policies are written by lawyers to maximize flexibility, not to constrain behavior.

The right question is: what can you structurally not do with my data, regardless of policy changes, employee access, or acquisition?

This is a question we think about constantly when building Selina. We route to frontier models via API, so inference data reaches a provider. That's a structural fact we can't policy-wash away. Selina's memory is encrypted at rest, but it is not end-to-end encrypted, because a slice of each request reaches the model provider during inference. Files and transfers through SelinaSEND can be zero-knowledge encrypted, because they don't need to hit a model. We state those distinctions because the alternative is hoping nobody asks.

Perplexity faces the same architectural reality. Any product routing to upstream model providers has the same chain-of-custody problem. The question is whether the product is transparent about it or whether you have to piece it together from help center articles and independent reviews.

Does Opting Out Actually Work?

Perplexity provides an AI Data Retention toggle in Account Settings. Turning it off should prevent your queries from being used for model training. The help center confirms this option exists.

Whether opting out changes what upstream providers do with your data is less clear. Perplexity's enterprise contracts bar providers from training on enterprise queries. Whether the same contractual protection extends to a consumer who flips the opt-out toggle is not stated in the public documentation I've reviewed. This is a meaningful gap. If opting out stops Perplexity from training but doesn't stop the upstream provider from retaining or training, the opt-out is incomplete.

Independent analysis notes the policy language is vague about what happens to data from opted-out users. Vague is not the same as bad, but it is insufficient for someone making a trust decision with real stakes.

Where Does This Leave a User Who Wants Answers Without Exposure?

If you're using Perplexity Free or Pro for casual searches, the risk profile is similar to using any major search engine: your queries are collected, retained, and potentially used for product improvement and training. The addition of upstream model providers adds one more link in the chain.

If you're pasting sensitive business information, legal questions, medical details, or anything you'd want attorney-client privilege over, the default consumer configuration is not built for that. The enterprise tier addresses some of these concerns with no-training guarantees and contractual protections on upstream providers. The Sonar API goes further with zero data retention.

The practical advice is boring but correct: check the AI Data Retention toggle. Understand that selecting a specific model routes your query to that model's provider. Don't paste anything into a consumer AI product that you wouldn't put in an email to a company whose data practices you haven't audited. And treat policy statements as intentions, not guarantees, unless they're backed by architectural constraints that make violation impossible.

Perplexity is a useful tool. It synthesizes web information faster than tab-hopping through search results. But "useful" and "private" are different claims, and conflating them is how sensitive data ends up somewhere you didn't expect.

If you want an AI assistant where memory is encrypted at rest and the product is built around not reading your data by design, start a free 7-day trial of Selina, no card required.

Michael C.

Founder & Principal Engineer, Selina Labs

Michael builds Selina, a privacy-first AI that remembers you across conversations. He ships security-sensitive AI in production — real attacks, real fixes, measured in minutes and dollars — and writes about privacy, security, and LLMs from that seat. Top Rated Plus and expert-verified on Upwork.

• www.upwork.com
• x.com
• medium.com
• selinalabs.io