Is “self-hosted” becoming a misleading privacy label in AI?

I keep seeing tools described as private because the app is self-hosted, even when inference or telemetry still leaves the machine.

How do you evaluate whether an AI setup is actually private?