What never gets typed in

We teach people to put a lot into AI. Your schedule, your writing, your recipes, the letter you've been dreading. Most of what's in your head is fine to share.

This page is about the small list that isn't. Keep it short enough to remember, and you'll never have to think about it again.

The never list

• ID numbers. Social Security, driver's license, passport, Medicare number.
• Full account numbers. Bank, credit card, investment, loan. "The Visa ending in 4417" is fine. The full number never is.
• Passwords and codes. Including PINs, security question answers and the six-digit code your bank texts you.
• Someone else's private details. Your parent's diagnosis with her name on it. Your kid's financial aid forms. A friend's divorce. It isn't yours to share.
• Identifiable health records. Strip the name, birth date and record numbers first, or leave it out.
• Work you've promised to keep private. Client files, anything under an NDA, other employees' records.
• Your legal strategy. More on this one below. It surprises most people.

One test that covers almost everything: would you be fine if this showed up on Google, or got read out loud in court? If not, it stays out.

Why each of these matters

Your chats are stored

• Deleting isn't instant. In Claude, a deleted chat leaves your history right away and is removed from Anthropic's systems within 30 days.
• Training keeps things longer. If the setting that lets your chats improve the model is on, they can be kept in de-identified form for up to five years.
• Rating a chat keeps it too. A thumbs up or down sends that whole conversation to Anthropic, where it can be kept for up to five years. Skip the thumbs on any chat with personal details.

Shared links can go public

In July 2026, Fortune reported that Claude conversations people had shared by link were showing up in Google search results. Some contained names, addresses and crypto wallet keys. The same thing happened to shared ChatGPT and Grok chats in 2025.

The lesson: a shared link is public to anyone who has it. Don't share a chat that has anything personal in it.

Chats can end up in court

• They aren't privileged. In February 2026, a federal judge in New York ruled that a defendant's conversations with Claude about his legal case were not protected the way talks with a lawyer are. AI isn't your attorney.
• They can be handed over in a lawsuit. In a copyright case against OpenAI, a court ordered the company to produce 20 million de-identified ChatGPT logs.

We're not telling you this to scare you off. We're telling you because "it's private, it's just me and the app" is the assumption that gets people in trouble.

Copycat apps are a separate risk

In February 2026, researchers revealed that a third-party AI chat app had exposed roughly 300 million messages from more than 25 million users because of a misconfigured database. It wasn't one of the big AI companies. It was an app built on top of them.

Use the real thing. Get Claude, ChatGPT or Gemini from the company's own website or official app.

Swap the details, keep the question

You almost never need the identifying part to get a good answer.

The answer comes back just as useful. The risk mostly disappears.

The settings to change today

Claude

• Turn off training. Settings, then Privacy, then "Help Improve our AI models." Look at your own toggle. Anthropic's help pages don't say what it's set to for a new account, so don't assume.
• Use incognito for one-offs. The ghost icon at the top right starts a chat that isn't saved to your history or memory and isn't used for training. It may still be kept for up to 30 days.

ChatGPT

• Turn off training. Settings, then Data controls, then "Improve the model for everyone."
• Use Temporary Chat for one-offs. It stays out of your history and memory. OpenAI says it may still keep it for up to 30 days for safety.

Gemini

• Know that people may read it. Google says a sample of chats is reviewed by humans, and reviewed chats can be kept for up to three years even if you delete them.
• Turn off Keep Activity if you don't want your chats used to improve Google's products. They're still kept for 72 hours.

Already pasted something you shouldn't have?

Don't panic. Do these in order.

1. Delete the chat. It leaves your history right away. Claude and ChatGPT remove deleted chats from their systems within about 30 days, with exceptions for flagged chats and legal holds. Gemini keeps chats a reviewer has already seen for up to three years.
2. Unshare it if you ever sent anyone the link.
3. Change the password if that's what you pasted.
4. Call your bank if you pasted a full card or account number, the same as if you'd lost your wallet.
5. Turn off training so it doesn't happen again.

One honest limit: if training was on and that chat was already used to train a model, deleting it doesn't pull it back out. That's why the setting comes first.

What we're still not sure about

The rules change. AI companies rename and move these settings regularly. Look at your own settings every few months rather than trusting a page like this one, including mine.

Checked against Anthropic, OpenAI and Google's own help pages, Fortune, and court reporting, October 2026. Settings move. If your screen doesn't match, trust the screen.