I've been researching the privacy implications of AI recently (in a word: scary), and as a result, I've been reading a lot of terms and conditions of different services.
Recently, I wanted to know how long the title of a pdf was, so I copied the title, went to my trusty site wordcounter.net and ...
Wait a second, what does wordcounter.net do with my data?
Luckily for me, WordCounter has a nice privacy policy, which is — per their own tool — 990 words long. But who wants to read 990 words of legalese?1
The tool was simple enough that I figured it was probably easier for me to have an AI tool (Cursor) code me up a website with the exact same functionality. I already have Github pages set up on a custom domain (kai-williams.com)2, so I figured it would be easy to add to the web.
After three iterations (to make it look nice), I have a perfectly functional word-count website up, which I now use instead of wordcounter.net. As far as I can tell, my website won't track you, other than giving GitHub your IP address, as per GitHub's documentation. I didn't set any cookies, and GitHub doesn't set any as of 2020.3 In any case, it was easy to look through the code (all 71 lines of html/css/javascript) and verify that it wasn't going to do anything with my inputs.4
I find this ironic. Broadly, AI poses a lot of challenges for privacy and security. Not only is AI-generated code often insecure, but AI companies often treat sensitive data ... without much care.5 However, if I want to do something simple, it's easier to write a small script using a large language model and check over the result than to figure out the privacy policy of a website.
I finally read over wordcounter.net's privacy policy, and it's not too bad as these things go. The company is based in Switzerland, and at least seems to follow the European data protection standards (GDPR). But they warn the user not to use the website with "any texts containing personal data of any kind." (The text goes to their servers, for unclear reasons?).
To figure that fact out, I had to wade through 6000 characters (990 words) of "college level" text (per their tool) to find the single sentence. If they hadn't included that warning, I would have had to decide the privacy implications of their other practices, like using Google Analytics. Easier to have AI make the tool, and I probably wouldn't have written it for myself.
I don't know what lesson to draw from this. If I looked hard enough, there's probably an online word counting page which keeps my data safe. (One or two looked promising after a quick search, though others seemed sketchy). I feel a little sad to be moving to a vibe-coded solution because it's easier to trust the AI's code than a random human.
Maybe this doesn't have much to do with AI at all, though. The biggest takeaway for me is "check dumb apps you use" rather than "use AI." The creature comfort of vibe-coding made it easier to transition to my own tool, but asking an LLM is not the only appropriate response.
P.S.: If you want to use the tool, feel free!6 But honestly, maybe make one for yourself.
-
Well me a lot of the time, but not in this case. Anyways, I ↩
-
Which now looking at it, I really need to update! It looks like I'm a domain squatter with how it currently looks. ↩
-
I had to read more privacy policies to write this paragraph than I would have to just figure out that wordcounter is probably fine. ↩
-
I don't know much technically about security, but the code does everything in the browser with simple javascript. I'm sure there are ways that the data could leak (please tell me!), but I would think they would have to be about my computer as a whole, rather than the website itself. ↩
-
There are so many things I could link here, but I'll point to a YouTube presentation I watched today where a start-up talks about trivially hacking other start-ups' AI agents. I found it an interesting snapshot, even outside of my technical expertise. ↩
-
The source code is also here though I note that it is all AI-generated. ↩
This is great, Kai!
Thank you!