Check two things: (1) Where does your AI run — your computer, a home device, or a VPS? Each has different privacy gotchas. (2) Is anything exposed to the public internet? Turn off Wi-Fi on your phone and try to access your AI — if you can, something is exposed. The #1 risk isn't AI itself, it's accidental exposure: 135,000+ OpenClaw instances were found publicly accessible due to configuration mistakes.