Privacy
What Not to Share With ChatGPT (and What's Actually Fine)
Published: · Updated:
Never share these with ChatGPT: passwords and login codes, ID, passport, card or bank account numbers, other people’s personal details (your clients, your patients, your kids), confidential work material (contracts, unreleased figures, source code under NDA), and medical or financial details tied to your real name. What’s actually fine: general questions, drafts and ideas, public information, and any text where you’ve swapped real names and numbers for placeholders. That’s the whole rule. The rest of this page explains why, and how to check a specific text in seconds.
Where your words actually go
This isn’t guesswork; it’s in OpenAI’s own documentation. OpenAI’s help centre says that on personal plans your conversations can be used to train future models, unless you switch off the setting called “Improve the model for everyone”. That covers the Free plan, and it also covers Go, Plus and Pro: paying for a personal plan does not, by itself, opt you out of training data collection. ChatGPT Business, Enterprise and Edu accounts are the exception: they’re excluded from training by default.
Two more facts worth knowing. Deleted chats are scheduled for permanent removal within about 30 days, but deleting a chat doesn’t reach back into a model that has already learned from it. And a limited number of authorised OpenAI staff and contractors may see conversations in certain cases: investigating abuse or a security incident, answering your support request, legal matters, or improving the models (unless you’ve opted out). OpenAI’s own advice is blunt: don’t enter sensitive information you wouldn’t want reviewed or used. None of this is sinister; it’s how these systems improve. It just means the chat box isn’t a private notebook, and you should treat it like a postcard, not a sealed letter.
The never-paste list, explained
Passwords, codes and API keys. There is no reason a chatbot ever needs these, and once typed they sit in your chat history where anyone with access to your account can read them.
Government IDs, card and account numbers. Identity-theft material. If you want help with a letter to your bank, “my account number” works exactly as well as the real digits.
Other people’s data. This is the one most people miss. Your customer list, a tenant’s complaint, your mother’s test results: under GDPR that’s personal data belonging to them. Picture a bar owner pasting a supplier’s email, names and prices included, to draft a reply. Useful? Very. But the supplier never agreed to be part of anyone’s training set. It’s just as true of pictures: a photo is other people’s data too, which is why uploading a photo with someone else in it is the one line worth never crossing.
Confidential work material. Contracts, unreleased numbers, anything covered by an NDA: this is confidential data, and on a personal plan it leaves your control the moment you paste it. The plan you’re on changes the answer, so it’s worth knowing what happens to a document you upload before you drag one in. If the question is really about your job rather than a single file, start with whether ChatGPT is safe to use for work at all.
Health and money details tied to your identity. Asking “what questions should I ask my doctor about knee surgery?” is fine. Pasting your full medical file with your name on it is not, so describe the situation instead of uploading the records.
What’s actually fine
Plenty, honestly. General questions, brainstorming, explanations, translations, cooking, code that isn’t proprietary, summaries of public articles: all fine. So is almost any sensitive topic, as long as you strip the identifiers: a plumber can describe “a customer in a 1960s building with lead pipes” without the customer’s name and address; you can draft a difficult email about “my colleague M.” The information that creates risk is almost never the part you need help with.
Make it safer in two minutes
Three settings do most of the work. First, turn off training: open Settings → Data controls → “Improve the model for everyone” and switch it off (menus get renamed occasionally, so look for “Data controls” or check OpenAI’s help pages if it has moved). This applies to your whole account and you can flip it back anytime. Second, use a Temporary Chat for anything sensitive; those conversations aren’t used for training and don’t stay in your history (OpenAI may keep a copy for up to 30 days for safety). Third, if you don’t want ChatGPT remembering details about you across conversations, review the Memory settings while you’re there. Turning training off is a clean opt-out: OpenAI confirms new conversations are then excluded from model training. One catch: if you give a thumbs up or down on a reply, OpenAI says the whole conversation behind that feedback may still be used for training.
Check before you paste
Rules are easy to forget at 11 pm with a deadline. That’s why we built the paste checker: drop in the text you’re about to send, and it flags API keys and lines written like “password: …”, card numbers and IBANs, email addresses, phone numbers, many street addresses, common health words and, often, a first and last name, before they leave your machine. It also recognises a handful of national ID numbers: the Spanish DNI and NIE, the Italian codice fiscale, the French social security number, the German tax ID and the Vietnamese citizen ID. It doesn’t know a passport number, a US Social Security number or a UK National Insurance number, and a password dropped into a sentence with no label in front of it slips through, so give the text one read of your own as well. It would defeat the point to route a list of secrets through someone else’s server first, so it doesn’t: the matching all happens on your own device, and nothing you paste is sent to us. Thirty seconds now beats explaining a leak later.
Keep reading
Frequent questions
Does ChatGPT use my conversations for training? +
On the personal plans (Free, Go, Plus and Pro), yes by default: your chats can be used to train future models unless you turn off the 'Improve the model for everyone' setting. ChatGPT Business, Enterprise and Edu accounts are excluded from training by default.
Is it safe to paste an email into ChatGPT? +
It depends on what's in it. An email with no names, account numbers or private details is fine. An email containing a client's name, prices, addresses or anything confidential should be stripped of those details first, or checked with a tool before you paste.
What happens to a chat after I delete it? +
Deleted chats are removed from your history immediately and scheduled for permanent deletion from OpenAI's systems within 30 days, unless OpenAI must keep them longer for security or legal reasons or they were already de-identified and separated from your account. Deleting a chat does not undo any training that already happened.
Can I share other people's information with ChatGPT? +
Not unless they've actually said yes. Guessing they wouldn't mind isn't the same thing, so ask them, or swap their names and details for placeholders before you paste. At work, the GDPR adds a legal layer: your clients', patients' or colleagues' names and contacts are their personal data, and every use of them needs a lawful basis under Article 6 (their consent is one, a contract with them is another), and for anything about someone's health, Article 9 sets stricter rules on top. Don't assume the reason you hold their data also covers pasting it into a chatbot. Purely private use, like planning a friend's birthday, falls outside the GDPR, but asking first is still the fair thing to do.