On-Device AI vs. Cloud AI: What Actually Happens to Your Documents
“Runs on your device” and “private by design” show up on a lot of app store listings. The distinction that actually matters isn’t the slogan — it’s a simple technical question: does your document leave your phone before the AI processes it, or not?
Two different architectures
Cloud AI — the document (or its text) is sent over the network to a server, a model running there processes it, and the result is sent back. This is how most AI features work today, including the AI built into many productivity and scanning apps. It’s not inherently unsafe, but it means a copy of your data existed, at least briefly, outside your device.
On-device AI — the model itself runs locally on your phone’s hardware. The document never has to leave the device to get summarized, tagged, or searched, because there’s no server round-trip in the process at all. If you turn on airplane mode, it still works, because there’s nothing to connect to.
Why this distinction matters more for documents than for, say, chat
A one-off chat message is low stakes. A document you scan and forget about is not: it accumulates. Over months of scanning bills, contracts, insurance paperwork, and medical letters, a cloud-based document app is building a remote copy of a meaningful slice of your financial and medical life — even if the provider has a good privacy policy and never misuses it. The exposure isn’t about intent, it’s about surface area: every document that touches a server is one more thing that could be affected by a breach, a subpoena, a policy change, or just a provider going out of business.
On-device processing removes that surface area entirely for the AI features themselves. There’s no server log of your documents to breach, subpoena, or repurpose, because it never existed.
How to actually tell if an app is on-device
Marketing copy is not proof. A few honest signals:
- Does it work with no internet connection? If AI summaries, search, or tagging still work in airplane mode, that’s a strong sign the model runs locally. If any of those features stop working offline, some part of the pipeline is server-based.
- Does the privacy policy describe what’s uploaded? A real on-device tool has very little to say here, because there’s very little data leaving the device to describe.
- Is there a visible “processing” delay tied to network speed? On-device inference speed depends on your phone’s chip, not your Wi-Fi. If performance changes noticeably on a slow connection, it’s probably a cloud call.
DocDuck is built this way deliberately: scanning, summarizing, tagging, and search all run locally, and the app works fully offline. The masking feature — blanking out IBAN, address, and phone number before a document is shared with any external AI assistant — exists specifically for the moments where you do want a cloud AI’s help, without handing it the identifying details first.
The takeaway
“Private” is a claim. “Works with no connection” is a fact you can test in five seconds by turning on airplane mode. When evaluating any app that touches sensitive documents, that’s the check worth running before trusting the label.