I opened a private AI chat. It still knew my name and my rough location.

I opened a private chat with an AI, the kind labelled Incognito, and asked it a completely generic question. It answered under a heading with my first name in it, and put me in a city about 30 miles from where I actually live. No name, no location, nothing personal in the question. The chat was meant to be private. It still knew who I was and roughly where.

I only checked because “private” and “greeted me by name” don’t sit well in the same sentence. So I ran it again. And again. Three times out of three, Perplexity’s Incognito mode placed me by the nearest big city. Twice, it went a step further and put my first name and the nearest big city into a heading, Recommendation for you (my first name, the nearest big city), as if it had quietly pulled my file.

The setup

I ran this across three tools, each in its own version of a private chat, all while logged in. Perplexity’s Incognito, Claude’s Incognito chat, and ChatGPT’s Temporary Chat on the free tier. Fourteen runs in total, spread over two sittings the same day, about twelve hours apart, each one started fresh, and I confirmed the private mode was on every single time.

The question was the same each run, and it had nothing personal in it: “Should I buy a house now, or keep renting and invest the difference? Give me a clear recommendation.” No location, no name, no mention of money I hold or where I hold it. The sort of thing anyone might type into a search box on a slow afternoon.

In a mode with “private” on the tin, I expected an answer that knew nothing about me. A generic reply about mortgages and rent and how long you plan to stay put. That is what I got from one of the three tools. The other two had opinions about where I should buy.

What actually came back

Perplexity’s Incognito mode knew my region every time, and my name most of the time. All three runs framed the housing question around the nearest big city, a place about 30 miles from where I actually live. Two of the three went further and addressed the answer to me by my real first name, under a heading built around it. Not a vague “in your area” either. A named city, and often a named me.

Here is the shape of it, genericised. I have swapped every real detail for its category, because a post about an AI leaking personal information would be a poor place to leak my own.

Claude’s Incognito chat was quieter. It greets you with “whoever you are”, which is a promising start, and most of my runs lived up to it: clean, generic, nothing about me. But not all. Across eight incognito runs in two separate sittings the same day, two of them named a city. No name, but a location it had no business knowing in a chat that had just called me “whoever you are”. Two in eight is not three in three, but it isn’t nothing, and the detail that makes it hard to wave away is that both runs named the same city, the twelve hours between them notwithstanding. One thing I’ll be fair about: that city is a stock example UK writers reach for when they want an affordable place to contrast with London, so a single mention could be coincidence. Two mentions, in separate sessions, of the one city that happens to be near me, is the bit coincidence has to work harder to explain.

ChatGPT’s Temporary Chat, on the free tier, was the clean one. Zero of three runs assumed anything. Instead of guessing, it asked: what’s your country and city? That is the correct behaviour. It didn’t use a location, it asked for one, rather than building an answer around a place it had quietly decided I lived in. One caveat before I hand it the medal: ChatGPT ran no web search in any of its three runs, while Perplexity searched every time. So the clean result might be down to the free tier not searching, rather than better isolation. I can’t tell the two apart from what I have.

Why “incognito” is doing a lot of work

The word “incognito” promises anonymity. The mode does not. I read what each tool actually says its private mode does, and not one of them claims to hide who you are.

Perplexity’s Incognito says your chats “won’t save to your history and expire after 24 hours”. Claude’s Incognito chat says conversations “aren’t saved, added to memory, or used to train models”. ChatGPT’s Temporary Chat says it “won’t appear in your chat history, and won’t be used to train our models”. Read them side by side and the pattern is plain: every one promises the chat is not saved, and not one promises you are anonymous while you have it.

So Perplexity greeting me by name is not a broken promise. It’s a mode doing exactly what it said, not saving the chat, while I quietly assumed the label meant something bigger. “Incognito” carries a spy-film weight, a hat and a turned-up collar, that “we won’t save this” simply does not. The gap between those two is where I caught myself out.

These modes promise the chat won't be saved. They never promise you're a stranger while you're having it. "Incognito" is the word that fills in the difference, and it fills it in wrong.

Claude is the one tool whose own framing is in mild tension with its behaviour. It opens with “whoever you are”, then two runs in eight named a city anyway. A smaller gap than the label problem, but the one place a tool’s words and its behaviour pointed in slightly different directions.

The two signals that survive private mode

Two different things about me got through, and they arrive by two different routes. Getting this right is what separates an honest write-up from a scare story.

The name is exact, and it comes from the account. Incognito does not log you out. You are still signed in, so the tool still knows precisely who you are, down to the first name on the account. That’s how Perplexity could greet me by name at all, and get it right. It wasn’t guessing. It was reading.

The location is approximate, and I can’t tell you for certain where it comes from. The city Perplexity named sits about 30 miles from where I actually live. That coarseness is a clue: it’s the nearest big city, the same rough guess a weather site makes when it shows you a forecast for a town you’ve never lived in. A location that landed on my actual town would point at something stored in the account; one that lands 30 miles out looks more like it’s worked out from my internet connection than from anything I typed. But I didn’t run the control that would settle it, a logged-out or VPN’d repeat, so I’m not going to claim I’ve ruled the account out. Approximate, yes. Exact source, unconfirmed.

So it’s not one leak, it’s two. Account identity, precise, surviving private mode because you’re still logged in. And a rough location, surviving private mode because it was never in the chat for the mode to strip. Neither is switched off by the word “incognito”. Log out and the name should go; the rough location is likely to stay until you do something about the connection itself.

The honest limits

A few things worth being straight about, because they change how you read this.

I ran this logged in, not logged out. That matters. The name only appears because I was signed in the whole time. Log out first and Perplexity has no account to read from, so the name should go. I tested the modes as most people actually use them, signed in, because that’s where the surprise lives. A logged-out test is a different experiment.

The sample is fourteen runs, not a study. Three of three for Perplexity is a clean, repeatable result; two of eight for Claude and zero of three for ChatGPT are real but lighter observations. Fourteen runs on one question shows the behaviour exists, not how often it shows up across every question type and account. One more thing that isn’t apples to apples: Perplexity and Claude were run on my own heavily-used accounts, while ChatGPT was a separate free-tier account, not a matched one, so its clean sheet may owe as much to the mismatch as to better isolation. I’d want a much bigger sample, on matched accounts, before saying anything stronger than “this is what happened, every time I looked”.

And a private chat is not an anonymous one. That’s the sentence I’d tape to the monitor. These modes are honest about what they do: they don’t show the conversation in your history. That’s genuinely useful. It’s just a narrower promise than the word “incognito” makes your brain reach for. If what you want is to not be saved to your history, they deliver. If what you want is to not be known, that’s a different button, and mostly it’s the log-out button plus a bit of care about your connection.

If you want the companion to this, does AI cave when you push back covers the other way a confident answer can quietly be one you shouldn’t trust: not what the tool knows about you, but how easily it abandons what it just told you the moment you disagree.

So now I read the top of a “private” answer the way I read the top of a form: for the details I never filled in. A tool greeting me by name in a session I opened to be private isn’t a bug to report. It’s a reminder that private meant one specific thing and I’d assumed a bigger one. The unsaved chat is real and useful; the disguise was never in the box. If you want the answer to know nothing about you, log out first, and remember that something, most likely the connection you’re on, is still quietly handing it a rough idea of where you’re sitting.