Privacy
What Not to Share With ChatGPT (and What's Actually Fine)
Published:
Never share these with ChatGPT: passwords and login codes, ID, passport, card or bank account numbers, other people’s personal details (your clients, your patients, your kids), confidential work material (contracts, unreleased figures, source code under NDA), and medical or financial details tied to your real name. What’s actually fine: general questions, drafts and ideas, public information, and any text where you’ve swapped real names and numbers for placeholders. That’s the whole rule. The rest of this page explains why, and how to check a specific text in seconds.
Where your words actually go
This isn’t guesswork; it’s in OpenAI’s own documentation. The Data Controls FAQ says that on personal plans your conversations can be used to train future models, unless you switch off the setting called “Improve the model for everyone”. That covers the Free plan, and it also covers Go, Plus and Pro: paying for a personal plan does not, by itself, opt you out of training data collection. Business and Enterprise accounts are the exception: they’re excluded from training by default.
Two more facts worth knowing. Deleted chats are scheduled for permanent removal within about 30 days, but deleting a chat doesn’t reach back into a model that has already learned from it. And human reviewers may see conversations in certain cases, for example when content is flagged. None of this is sinister; it’s how these systems improve. It just means the chat box isn’t a private notebook, and you should treat it like a postcard, not a sealed letter.
The never-paste list, explained
Passwords, codes and API keys. There is no reason a chatbot ever needs these, and once typed they sit in your chat history where anyone with access to your account can read them.
Government IDs, card and account numbers. Identity-theft material. If you want help with a letter to your bank, “my account number” works exactly as well as the real digits.
Other people’s data. This is the one most people miss. Your customer list, a tenant’s complaint, your mother’s test results: under GDPR that’s personal data belonging to them. Picture a bar owner pasting a supplier’s email, names and prices included, to draft a reply. Useful? Very. But the supplier never agreed to be part of anyone’s training set.
Confidential work material. Contracts, unreleased numbers, anything covered by an NDA: this is confidential data, and on a personal plan it leaves your control the moment you paste it. Several large companies restrict chatbot use for exactly this reason.
Health and money details tied to your identity. Asking “what questions should I ask my doctor about knee surgery?” is fine. Pasting your full medical file with your name on it is not, so describe the situation instead of uploading the records.
What’s actually fine
Plenty, honestly. General questions, brainstorming, explanations, translations, cooking, code that isn’t proprietary, summaries of public articles: all fine. So is almost any sensitive topic, as long as you strip the identifiers: a plumber can describe “a customer in a 1960s building with lead pipes” without the customer’s name and address; you can draft a difficult email about “my colleague M.” The information that creates risk is almost never the part you need help with.
Make it safer in two minutes
Three settings do most of the work. First, turn off training: open Settings → Data Controls → “Improve the model for everyone” and switch it off (menus get renamed occasionally, so look for “Data Controls” or check OpenAI’s help pages if it has moved). This applies to your whole account and you can flip it back anytime. Second, use a Temporary Chat for anything sensitive; those conversations aren’t used for training and don’t stay in your history. Third, if you don’t want ChatGPT remembering details about you across conversations, review the Memory settings while you’re there. Turning training off is a clean opt-out: OpenAI confirms new conversations are then excluded from model training.
Check before you paste
Rules are easy to forget at 11 pm with a deadline. That’s why we built the paste checker: drop in the text you’re about to send, and it flags passwords, ID numbers, names and other risky elements before they leave your machine. It would defeat the point to route a list of secrets through someone else’s server first, so it doesn’t: the matching all happens on your own device, and nothing you paste is sent to us. Thirty seconds now beats explaining a leak later.
Keep reading
Frequent questions
Does ChatGPT use my conversations for training? +
On the personal plans (Free, Go, Plus and Pro), yes by default: your chats can be used to train future models unless you turn off the 'Improve the model for everyone' setting. Business and Enterprise accounts are excluded from training by default.
Is it safe to paste an email into ChatGPT? +
It depends on what's in it. An email with no names, account numbers or private details is fine. An email containing a client's name, prices, addresses or anything confidential should be stripped of those details first, or checked with a tool before you paste.
What happens to a chat after I delete it? +
Deleted chats are removed from your history immediately and scheduled for permanent deletion from OpenAI's systems, typically within 30 days, unless the law requires longer retention. Deleting a chat does not undo any training that already happened.
Can I share other people's information with ChatGPT? +
You shouldn't, unless they'd be comfortable with it. Under the GDPR, other people's names, contacts and details are their personal data, not yours, and pasting them into a chatbot is a use they never agreed to.