Is It Safe to Put Your Information Into AI Tools?

It depends on three things: which tool, which account you are signed into, and what you paste. A free consumer chatbot and the same company's business product frequently have opposite defaults on whether your conversation is used to train the model. Nothing you type is as private as a note to yourself. Most of the real risk is avoidable once you know where to look.

What happens when you press send

Your text leaves your device for the company's servers, because the model runs there rather than on your laptop. What happens next is set by product policy, not by anything visible in the chat window, and that policy belongs to whoever built the chatbot in front of you rather than to the model it calls.

Four things are commonly true at once. The conversation is stored, so you can return to it. It may be used to improve future versions of the model. It may be read by a person: Google's Gemini Apps Privacy Hub states that human reviewers assess conversations, and that reviewed chats are kept up to three years, separated from your account. And it may persist after you delete it.

Training use is narrower than it sounds. Almost everything a model knows was gathered before you opened the app, which is the subject of where training data actually comes from. Your conversation, if it is used at all, is one small addition to that. It is still your text.

The US National Institute of Standards and Technology treats this as a named risk. Its Generative AI Profile, published in July 2024, lists Data Privacy among twelve risks specific to generative systems and notes that models "may leak, generate, or correctly infer sensitive information about individuals."

Consumer and business accounts often have opposite defaults

The same company often ships one set of defaults to individuals and the reverse set to paying organizations.

OpenAI's help documentation, current as of September 2026, describes the split. For individual accounts it says "we may use your content to train our models," with an opt-out in settings. For business products it says "By default, we do not train on any inputs or outputs from our products for business users," covering Business, Enterprise and the API.

The trade in a work account is worth naming: stronger contractual protection against training, less privacy from your employer. OpenAI's help page on deleting chats notes that "Authorized compliance tools may still access eligible workspace data under your organization's retention policy." A work account is not a private account.

Defaults also move. Anthropic announced on 28 August 2025 that Claude Free, Pro and Max users would be asked to choose whether their conversations could be used for training, with five-year retention for those who allow it and 30 days for those who decline, and that the change did not apply to its commercial products. One company, one date, and it makes the general point: whatever you confirm today has a shelf life.

What a review of the major privacy policies found

In September 2025, Stanford researchers led by Jennifer King published an analysis of the privacy policies of six frontier AI developers, as those policies stood in May 2025: Amazon, Anthropic, Google, Meta, Microsoft and OpenAI. Reading 28 documents across the six companies, they found that all six "appear to employ their users' chat data to train and improve their models by default," that some retained it indefinitely, and that the policies often omitted basic information about what was collected and for how long. Companies running many products also merge chatbot interactions with data from elsewhere in their services, and most did not filter children's conversations out of training sets.

Two caveats matter: this is a reading of published policies at a fixed date, not an audit of internal systems, and several of those policies have changed since. The paper accounts for one of those changes itself, noting that Anthropic moved consumer accounts from opt-in to opt-out in August 2025, which is a move toward training on chat data rather than away from it. King's advice in Stanford's October 2025 write-up was narrow and reasonable. Think twice before sharing sensitive personal or health details, and opt out of training wherever the option exists.

Deleting a chat is a policy, not a physical law

Delete usually means scheduled for deletion. OpenAI says a deleted conversation leaves your account view immediately and is scheduled for permanent deletion within 30 days, "unless it was already de-identified and disassociated from your account or OpenAI must retain it longer for security or legal obligations."

That final clause did real work. In the copyright case brought by The New York Times, a court ordered OpenAI to preserve consumer ChatGPT output data it would otherwise have deleted. OpenAI said on 5 June 2025 that the order covered Free, Plus, Pro and Team, now called Business, along with API customers without a zero data retention agreement, but not Enterprise or Edu. That preservation obligation ended on 26 September 2025 and OpenAI returned to deleting content within 30 days.

The data already preserved did not go away. In November 2025 the court ordered OpenAI to hand 20 million of those conversations to the plaintiffs, and a district judge upheld that order on 5 January 2026. OpenAI says the sample was drawn from December 2022 to November 2024, that it does not cover Enterprise, Edu, Business or API customers, and that the conversations are de-identified before release. As of September 2026 the dispute over that production is still running.

The lesson is not about one company. A deletion promise describes ordinary operations, and litigation can suspend it and then reach back into what was kept. Treat "I deleted it" as better than nothing, not as proof the text is gone.

Anything a memory feature saved from a conversation is a separate record with its own delete button, covered in what the product stores about you.

What not to paste

The UK National Cyber Security Centre set out two rules in March 2023 that still hold: do not include sensitive information in queries to public chatbots, and do not submit anything that would cause a problem if it were made public.

Canada's Get Cyber Safe programme, in guidance dated 6 December 2024, names social insurance numbers, financial information and account credentials specifically, and adds that "once you provide your data, you lose control over where it goes and who can see it."

The Office of the Privacy Commissioner of Canada, in guidance updated 6 May 2025, covers the part people forget. It advises limiting identifiable detail, altering names where you can, and never sharing pictures or personal information of minors. Much of what ends up in a chatbot belongs to someone else: a colleague's performance issue, a friend's diagnosis, a client's contract. You are disclosing it on their behalf.

Google says the same thing from the vendor side: "Please don't enter confidential information that you wouldn't want a reviewer to see or Google to use to improve our services."

A workable test is whether you would be comfortable with the text appearing in a support ticket at that company. If not, rewrite it first. Replacing names with roles, cutting account numbers and describing a situation rather than pasting the document usually costs nothing in answer quality.

How to check the tool in front of you

Three checks cover most cases and outlast any menu redesign. They take two minutes per tool, once, and they sit alongside the ordinary habits of using AI well.

Find the training setting. It nearly always lives under an account menu, in a section called Privacy, Data controls or Activity, and the wording refers to improving the model or saving activity. Turning it off usually stops future conversations being used for training. It does not delete existing history, a separate control.

Find the retention setting. Some products let you choose how long activity is kept, and some offer a mode that skips history entirely. In ChatGPT that is Temporary Chat, which OpenAI says is not used for training and is deleted after 30 days. Google keeps chats 72 hours when activity is off.

Search the terms for two words rather than reading the document: "train" and "retention". Nearly every sentence that affects you sits next to one of them. If the tool is a small product built on a larger model, check what it says about the underlying provider, because a thin wrapper inherits that provider's handling of your text.

Tools that act on your behalf need more care than tools that only answer. An assistant with access to your inbox can be manipulated by instructions hidden in what it reads, a problem called prompt injection, so the question becomes what the tool can reach as well as what you type. Our guide to AI agents covers the difference.

If you have already pasted something sensitive

The right response depends on what it was.

A password, API key or access token: change it. That is the one case with a clean fix, and speed matters more than tidiness.

A financial or government identifier: deletion helps but does not undo the disclosure. Watch the account, and use any fraud monitoring you have.

Confidential work material: tell whoever owns that risk at your organization. Unwelcome, and almost always better than the alternative, because your employer may have an agreement with the provider that changes the options.

In every case, delete the conversation and check whether the training setting was on at the time. If it was, turn it off and look for the provider's data deletion request form, which many jurisdictions require. Opting out later may not remove content already used.

Sharing a chat is a publishing decision

The one habit worth forming applies before anything goes wrong. In late July 2025 OpenAI removed a feature that let a shared chat link be discoverable by search engines, after Fast Company found thousands of such conversations indexed by Google. The option was opt-in, and people checked it without understanding the consequence. OpenAI's chief information security officer said it "introduced too many opportunities for folks to accidentally share things they didn't intend to."

That particular feature is gone. The decision it exposed is not. A share link is a copy of the conversation living outside your account, readable by anyone who has it, and it carries the whole thread rather than the one answer you meant to show someone. Read back what you are about to publish.

That is the short version of the whole article. Know which account you are signed into, know what the training setting is doing, and decide what goes in before you type it rather than after. Those three habits are available on every tool, they survive every redesign, and they cover most of the risk you can actually control.