Original diagram — what happens to a prompt after it leaves your device. Three possible destinations, none of them fully under your control.

How to Use AI Chatbots Without Giving Away Your Personal Data

Every time you type into ChatGPT, Gemini, Claude or Copilot, you are sending text to a company's servers, where it is processed, may be stored, may be read by staff, and may be used to train future models. Which of those things actually happens depends on the service, the account type, and a handful of settings most people have never opened.

This guide explains what actually happens to a prompt, what the settings do, and what you should and should not paste into a chatbot. It is written with one honest constraint in mind: the specific policies of these services change frequently. Rather than giving you a snapshot that will be wrong in six months, the article teaches you where to look and what to check, so you can verify the current state yourself.

The practical takeaway at the top: do not paste anything into a chatbot that you would not put in an email to a stranger. Everything else in this article is a refinement of that rule.

Key takeaways

• Chatbot conversations are not confidential in the way a private diary is. They are processed on someone else's servers.
• Most services offer a setting to opt out of model training. It is not always the default, and it is worth finding.
• Enterprise and API tiers generally offer stronger guarantees than consumer apps. The same company's product behaves differently depending on how you access it.
• Temporary or incognito chats exist in several services and are the closest thing to a private session.
• Local AI models — running on your own device — are the only option where no data leaves your machine. The trade-off is capability.

In this guide

1. What happens to your prompt
2. What never to paste, and what is fine
3. The settings worth finding
4. Consumer, paid, and enterprise: why the same product behaves differently
5. The local alternative
6. What to do if you already pasted something sensitive
7. Frequently asked questions

1. What happens to your prompt

When you send a message to a chatbot, three things happen almost immediately. The service processes it to generate a response. It records the conversation in some form so you can return to it later. And, depending on the service and your settings, it may add the conversation to a pool used for training future models or for quality review by human staff.

These are three separate questions, and each has a different answer for each service:

Is it stored? Almost always, at least for a defined retention period. Storage is what allows you to see your chat history and continue a conversation across sessions. The question is how long and under what conditions.

Is it used for training? This varies significantly. As of writing, most major services offer a way to opt out, but the default has not always been opt-out. Some services train on your conversations unless you turn off a specific setting; others do not train on them by default. Check the current state of whichever service you use — this is one of the most frequently changed policies in the industry.

Can a human read it? This is the question most people never ask. Several services employ staff or contractors who review conversations for safety, quality and training purposes. These reviews are usually on a sample rather than everything, and access is typically restricted, but "a person may read this" is a meaningful distinction from "only a machine sees it."

None of this is necessarily a problem. For most uses, the trade is reasonable: you get a capable assistant, in exchange for the service seeing what you type. The point of understanding the mechanics is to make that trade consciously, and to avoid the specific cases where it is a bad trade — which is what the next section is about.

The one-sentence rule that covers most cases: do not paste into a chatbot anything you would not put in an email to a stranger. Not because the company is malicious, but because "confidential" is not a word that accurately describes an environment where a prompt is processed on someone else's server and may be reviewed.

2. What never to paste, and what is fine

Original diagram — three categories, in order of how much care they deserve. The red category is not negotiable.

A few specifics worth explaining rather than just listing.

API keys and credentials are the most common accidental leak. People paste code into a chatbot to debug it, and the code contains a database password, a private API key, or a connection string with credentials embedded. If the conversation is retained, the credentials are retained. If it is used for training, they become part of the training corpus. If a human reviews the conversation, they have seen your credentials. Most services have automated filters that detect and redact credential-shaped strings, but relying on those is not a strategy.

Photos and documents deserve their own caution. Some chatbots accept uploaded images and files. An uploaded image is processed the same way as text — stored, potentially reviewed, potentially used for training. A photo of a boarding pass, a prescription label, an ID document, or a business card contains a lot of information that survives even if you later delete the conversation.

Other people's data is a genuinely difficult category. If you ask a chatbot to "summarise this complaint from a customer" and you paste the complaint verbatim, you have transmitted that customer's personal data to a third-party service without their knowledge. In many jurisdictions — particularly under GDPR in the EU and UK — this is a data protection issue for you, not just a privacy preference. Redacting names and identifiers before pasting is a reasonable minimum.

Medical questions are fine; medical records are not. Asking "what are the symptoms of a sinus infection?" is a perfectly reasonable use of a chatbot. Pasting your actual medical history, test results or prescription list is not, because it becomes a permanent record in a system you do not control. Describe the condition, not the file.

3. The settings worth finding

Most services offer controls over what happens to your conversations. The exact labels and locations change, sometimes more than once a year, so rather than giving specific menu paths that may already be out of date by the time you read this, here is what to look for in each service's settings.

Setting to look for	What it does	Where it usually lives
Model improvement / training data	Controls whether your conversations are used to train future models	Data controls or Privacy section in settings
Chat history	Whether conversations are saved so you can return to them later	Data controls; sometimes also available as "temporary chat"
Activity retention	How long the service keeps records of what you have done	Google account activity settings for Gemini; per-service equivalent elsewhere
Temporary / incognito chat	A session that is not saved to history and not used for training	Toggle inside the chat interface itself, not in settings
Delete conversation history	Removes stored conversations; may not remove anything already used in a training cycle	Chat sidebar, usually via a menu per conversation or a bulk delete option

Two things worth knowing about how these settings behave in practice.

Turning off training affects future conversations, not past ones. If your conversations were already used in a training cycle, switching the setting off does not un-train the model. This is not a reason to skip the setting; it is a reason to set it before you start using the service seriously, rather than after.

Deleting a conversation removes it from your history, but does not necessarily remove it from all systems. Most services state that deleted conversations are removed from their systems within a defined period, but there may be backups, audit logs, or legal retention that outlive your deletion. Read the service's own statement rather than assuming deletion is instant and total.

Temporary chat modes — where they exist — are the closest thing to a private session. They do not save the conversation to your history, and typically they are excluded from training. They still go to the service's servers (the model runs there), so this is "not retained" rather than "not transmitted." It is a meaningful difference, but not the same as using a local model.

If you are trying to reduce your overall exposure, the earlier guide on creating strong passwords covers the adjacent problem: even if you keep credentials out of chat conversations, they still need to be stored somewhere safe.

4. Consumer, paid, and enterprise: why the same product behaves differently

This is the part of the story that gets the least coverage and probably matters the most for anyone using AI at work.

The same company can offer multiple versions of what appears to be the same product, with significantly different data handling. The categories are generally:

Tier	Typical data handling	What to check
Free consumer app	Often trains on conversations unless you opt out. Frequently subject to human review for quality and safety.	Whether the training opt-out is on. Whether temporary chat is available.
Paid consumer subscription	Usually the same data handling as the free tier — the paid tier buys features and capacity, not necessarily privacy.	Whether the paid tier changes the training default. This varies significantly and is often not what people assume.
Business / enterprise tier	Usually does not train on customer data by default, and offers stronger contractual guarantees about retention and access.	The specific contract terms your organisation has signed. If your employer provides access, ask IT rather than checking a consumer settings page.
API access	Typically does not train on customer data by default — developers building on the API expect their application data not to become training material.	The provider's developer terms. Some services offer a "zero data retention" option at enterprise scale.

The practical consequence: do not assume that a paid subscription means better privacy. In several services, the paid tier is about usage limits and model access, not about data handling. The enterprise tier is where the guarantees usually change.

If you use AI for work and your employer has not provided guidance, the honest answer is that you should ask. Pasting customer data, internal documents or code into a consumer chatbot is a decision your organisation is probably already covered for by a separate enterprise agreement — or it is a compliance issue that has not surfaced yet. Either way, IT knows better than the settings page.

5. The local alternative

The only way to guarantee that no data leaves your device is to run the model on the device. This is now genuinely possible for capable models, and it is worth knowing about even if you decide it is not for you.

On desktop: tools like Ollama, LM Studio and the open-source Llama models let you download a model file and run it entirely on your own computer. Once the model is downloaded, no internet connection is required and no data leaves the machine. The trade-off is capability — smaller models that can run on a typical laptop are less capable than the large cloud models, though the gap has narrowed considerably for many everyday tasks.

On phone: Apple Intelligence runs a small amount on-device but hands more complex requests to Private Cloud Compute, which Apple describes as processing on dedicated servers without retaining the data. Some Android devices have a small on-device Gemini Nano model. These are genuinely more private than cloud-only processing, but they are not the same as running a full model on-device.

The honest assessment: local models are the right answer for a small set of use cases — processing sensitive documents, coding with proprietary code, working with client data in a legal or medical setting. For everything else, the practical choice is to use a cloud service with the appropriate settings rather than to run a weaker model locally for the sake of principle.

This connects to the earlier guide on what end-to-end encryption actually protects — the same principle applies here. The question is not whether a system is "secure" in some abstract sense, but specifically who holds the data and under what conditions.

6. What to do if you already pasted something sensitive

This happens to careful people. The response matters more than the mistake.

1. If it was a password or credential, change it immediately. Treat it as leaked regardless of what the service's policy says. This is the same response as any other credential exposure, and the earlier guide on creating strong passwords covers the wider habit.
2. Delete the conversation from your chat history. This removes it from what you can see, and starts the clock on whatever deletion policy the service has. It does not undo anything already used in training.
3. Turn off training in settings if it was on. This affects future conversations, not past ones, but it should be done now rather than later.
4. If it was someone else's data, consider whether you need to inform them. In a work context, that may mean telling your manager or your data protection officer. In a personal context, it depends on the relationship and the sensitivity.
5. If it was financial information — a card number, a bank account — contact your bank and treat it as you would any other exposure. The chatbot is not the risk in itself; the risk is that the data now exists somewhere it should not.
6. If it was a document or image that could identify you or someone else, consider whether the data protection consequences require reporting. Under GDPR in the EU and UK, an accidental disclosure of personal data can be a reportable incident depending on the risk.

There is no way to unring the bell for anything already used in training. The realistic response is to contain the damage from the specific credential or data that was exposed, and to change the habits that led to it.

Where this leaves you

AI chatbots are genuinely useful, and the privacy concerns are real. Both of those things are true, and neither cancels out the other. The practical approach is to use them, with the settings configured for how you actually want your data handled, and with a clear sense of what should never go into a prompt in the first place.

The two most important habits: opt out of training before you start using a service seriously, and never paste credentials into a chat. Everything else is refinement.

And the honest framing that ties this to a broader principle: the fact that a conversation "disappears" from your chat history does not mean it was never seen. The service processed it, may have retained it, may have reviewed it, and may have trained on it. Understanding what actually happens is more useful than trusting what the marketing implies.

Frequently asked questions

Does ChatGPT train on my conversations?

As of writing, ChatGPT offers a setting that controls whether conversations may be used to improve the model, and this setting has changed defaults at least once since the service launched. The reliable answer is to check the current setting in your account's data controls, not to rely on what was true six months ago. OpenAI's help documentation is the authoritative source.

Is Gemini different from ChatGPT on privacy?

Each service has its own policies and settings, and they change independently. Gemini's data handling is tied to your Google account activity settings, which means it interacts with other Google services in ways that a standalone account does not. Check Google's own documentation for the current state rather than relying on a comparison in an article.

Does paying for a subscription make it private?

Not necessarily. In several services, the paid consumer tier is about usage limits and model access, not about data handling. The enterprise tier is where the stronger contractual guarantees usually apply. Do not assume that paying money changes the privacy default — check the specific setting.

What is a temporary chat?

A session that is not saved to your chat history and is typically not used for training. It exists in several services under different names. It is closer to a private session than a normal chat, but the messages still travel to the service's servers for processing — it is "not retained," not "not transmitted."

Can I use AI without any data leaving my device?

Yes, by running a model locally on your own computer. Tools like Ollama and LM Studio can run open-source models like Llama entirely offline. The trade-off is capability: the models that fit comfortably on a consumer laptop are generally less capable than cloud models, though the gap has narrowed considerably for many everyday tasks.

Is it safe to paste code into a chatbot?

Generally yes, provided the code does not contain credentials, internal URLs, or proprietary business logic you would not want transmitted. The most common accidental leak is a code snippet with an API key, database password, or connection string still in it. Strip those first, or replace them with placeholders.

Does deleting a conversation remove it from the service?

It removes it from your visible history, and most services state that it is deleted from their systems within a defined period. It does not undo anything already used in a training cycle, and there may be backup or audit copies that outlive your deletion. Read the specific service's statement rather than assuming deletion is instant and complete.

What about AI features built into other apps — email, search, office software?

The same questions apply, but the answers are usually harder to find because the AI feature is embedded in a larger product rather than being a standalone service. The account settings for the parent product (your email provider, your search provider, your office suite) usually control the data handling, and the AI feature inherits those settings rather than having its own. This is another reason to review account privacy settings periodically rather than treating each AI feature as a separate decision.

---

A note on accuracy: this article deliberately does not state specific retention periods, training defaults or settings paths for individual services, because those have changed multiple times since consumer AI services launched and are likely to change again. The authoritative source for any specific service is that service's own help documentation and privacy notice. What this article covers — what questions to ask, where the settings live in general terms, and what should never be pasted regardless of settings — is stable across those changes.

Sources and further reading: OpenAI Help Center on data controls and model improvement; Google's Gemini Apps privacy documentation and account activity settings; Anthropic's privacy policy and Claude data handling documentation; Microsoft's Copilot privacy documentation (consumer and enterprise); Apple's Private Cloud Compute security documentation; Ollama, LM Studio and the Llama model documentation (for local model options); EU General Data Protection Regulation (GDPR) — for the personal data handling question.