Data privacy and security

Protecting your data when using ChatGPT

It’s a fair question: when you type something into ChatGPT, where does that text go, and is it used to train models? The answers are public, and the relevant settings fit on just a few screens. But you need to know them before pasting a confidential document into a conversation.

What OpenAI does with your conversations

On individual plans, OpenAI may use your conversations to train its models: in personal Free, Plus, and Pro spaces, this sharing is enabled by default. OpenAI states it reduces the amount of personal information in its training datasets, but the choice is yours. To opt out, turn off Improve the model for everyone in Settings > Data controls, or choose “Do not train on my content” in the OpenAI Privacy Portal; either one is enough. Your conversations stay in your history; only new conversations stop being used for training.

Three nuances matter. A thumbs-up or thumbs-down rating authorizes the use of the entire conversation, even if you opted out of training. Audio has its own setting, Include your audio recordings. And custom instructions can be partially shared with developers of the third-party plugins you use: connect only trusted apps.

Business, Enterprise, and Edu plans change the game: OpenAI does not use messages, responses, or files from these plans to improve its models unless the organization chooses otherwise.

Privacy tools

For a one-off exchange that must leave no trace, start a temporary chat: new conversation, then Temporary. While it remains temporary, it doesn’t appear in your history, creates or modifies no memories, and isn’t used for training; however, OpenAI may retain it for up to 30 days for security reasons. Before your first message, choose whether it can rely on your memory and instructions (Personalized) or not (Unpersonalized).

To keep a conversation but hide it, for example before screen sharing, use Lock chat in its ••• menu: it disappears from history and search, and opens only with a four-digit code, or Face ID and Touch ID on mobile. This lock isn’t encryption: it changes neither retention periods nor training settings. Warning: resetting this code permanently deletes locked conversations.

Finally, memory is controlled in Settings > Personalization > Memory: there you can read a summary of what ChatGPT remembers, correct it, or turn the feature off. Deleting a conversation doesn’t automatically erase a memory derived from it: check memory separately. The Privacy Center, accessible from the Help menu on the web and from settings on mobile, gathers all these explanations and links to the right setting.

What has no place in a conversation

Regardless of your configuration, certain information should never be entered. Passwords and credentials first: ChatGPT isn’t a safe. Next come credit card numbers and personal financial data, detailed health data like a patient’s medical record, and anything classified.

Two categories are less obvious yet equally exposed. Third-party personal data shared without consent: names, addresses, social security numbers. Proprietary source code, next, once it contains API keys or other secrets: pasting a config file “just to understand an error” is the most common and costly mistake.

One question settles doubtful cases: would you be comfortable if this information were published online? If the answer is no, don’t send it, or anonymize it first.

Anonymize rather than give up

Anonymization lets you work with sensitive data without exposing it. Replace names with pseudonyms like “Client A” or “Employee B,” remove direct identifiers (emails, phones, addresses), round figures that could identify an entity, and strip metadata from files before attaching them. The analysis remains valid: ChatGPT reasons about structures and trends, not people’s identities. You can even ask it to do this work on an excerpt already stripped of the most sensitive data:

“Here’s a dataset I want to analyze. Before we start, help me anonymize it by replacing names with codes and removing identifying information.”

Three profiles, three configurations

For strictly personal use with no sensitive data, keeping memory on adds real convenience; decide on training based on your comfort level. For professional use on non-sensitive data, turn off training if your organization requires it, keep memory on but review what it retains regularly, and secure the account with two-factor authentication. For sensitive data, use your organization’s plan (Business or Enterprise), anonymize systematically, and use temporary chats.

Your rights in Europe

If you live in the European Economic Area, the data controller for your data is OpenAI Ireland Limited, in Dublin. The GDPR gives you the right to access your data, have it rectified or deleted, retrieve it for transfer, restrict its processing, and object to it in certain cases; you can also contact your country’s data protection authority, the CNIL in France. Request an export in Settings > Data controls, under Export, and permanent account deletion is done from settings or the Privacy Portal.

Your turn

Tour your settings. Open Settings > Data controls and decide whether your conversations should be used for training. Read what ChatGPT has remembered about you in Settings > Personalization > Memory, and correct what needs correcting. Open a temporary chat and verify it doesn’t appear in history. Finally, request a data export to see what’s being retained. If you use ChatGPT at work, reread your organization’s policy on AI tools: many have one, few have read it.

Official sources: Data controls in ChatGPT (OpenAI Help Center: training, temporary chats, export, deletion) · How your data is used to improve model performance (portal, thumbs feedback, business plans) · Temporary chat in ChatGPT · Using locked chats in ChatGPT · Privacy Center in ChatGPT · EU Privacy Policy (data controller, rights)

Key takeaways

• On individual plans, training on your conversations is enabled by default; a single setting turns it off without losing history
• A thumbs-up or thumbs-down shares the entire conversation, even after opting out of training
• Use temporary chats to leave no trace, locked chats to hide, and review memory regularly
• Never share passwords, financial data, detailed health records, or secrets; anonymize the rest
• In Europe, OpenAI Ireland is the data controller, and the GDPR grants you rights to access, rectify, and delete