Retention, training, human review and whose data it legally is — four separate questions people collapse into one.
- Start from the default. Without a written agreement, assume what you type may be stored, read by a person and used to improve the service.
- Four questions, four answers. Retention, training, human review and legal ownership are separate, and a yes to one tells you nothing about the others.
- The plan matters, not just the brand. Consumer and business products from the same company often differ on training, which is frequently switched on by default for consumers.
- Your consent does not cover other people. Pasting someone else’s personal data, client material or credentials is a mistake you cannot undo.
- Check the setting. Find the training toggle in the tool you use most, decide deliberately, and look again after major updates.
Unless you have a written agreement saying otherwise, assume that what you type may be stored, may be reviewed by a person, and may be used to improve the service. That is not cynicism about any particular company — it is the industry default that most terms permit, and it is the safest assumption to start from. Everything below is how to do better than the default.
Four separate questions
These get collapsed into "is it private?", which is why people end up confused. They have different answers, and a yes to one tells you nothing about the others.
Is it retained — and for how long?
Storing your conversation is not the same as training on it. Most services keep history so you can return to it, and hold logs for a period for abuse and debugging purposes even after you delete a chat.
Is it used to train the model?
The question people actually mean. It commonly differs between consumer and business products from the same brand, and sometimes between the free and paid tiers of one company — which is why "does company X train on my data" has no single answer.Read at source 11 Sep 2026 — Anthropic, "Updates to Consumer Terms and Privacy Policy", August 2025: training applies to "Free, Pro, and Max accounts when this setting is on", and the update explicitly does not apply to "Claude for Work, Claude for Government, Claude for Education, or API use, including via third parties such as Amazon Bedrock and Google Cloud’s Vertex AI". Retention follows the same switch: five years if model training is on, the existing 30 days if it is off. Note the limit of this example: it splits consumer from business, not free from paid — Free, Pro and Max are treated alike. Amended 11 Sep 2026; the free-versus-paid half of this sentence is the weaker one.
Can a person read it?
Separate again. Many services allow staff or contractors to review a sample of conversations for safety and quality, and legal process can compel disclosure. This is ordinary across software and usually disclosed rather than concealed.
Whose data is it, legally?
If you paste something belonging to your employer, a client, or another person, your consent is not the consent that matters. It is also the harm most within your own control — not a company misusing data, but someone pasting material they had no right to share.
Ask the four questions separately about the tool you use, and look each answer up where it is written down rather than assuming one yes covers the rest.
Three levels of exposure
Consumer accounts, free or paid
Broadest permissions, training frequently enabled by default, and the least contractual protection. Paying does not necessarily change that: the Anthropic terms cited above treat Free, Pro and Max accounts alike. Perfectly fine for ordinary use; the wrong place for anything sensitive.
Business, enterprise and API plans
Usually stronger commitments, often excluding training by contract, sometimes with configurable retention. The protection comes from the agreement, so it is only as good as the agreement you actually have.
A model on your own hardware
Nothing leaves the machine, so retention, training and review stop being policy questions and become physical impossibilities. The trade is capability and convenience.See local or cloud and open or closed, both published 22 Aug 2026
Match the account to the material: keep anything sensitive for an account covered by an agreement, or for a model running on your own hardware.
What to actually do
- Check the setting once. Find the training toggle in whichever tool you use most and decide deliberately. Five minutes, permanent effect.
- Separate your accounts. Sensitive work on the account governed by an agreement; casual questions anywhere. Using one account for both is how sensitive material ends up on the weaker terms.
- Do not paste what is not yours. Other people's personal data, client material, credentials — the one mistake on this page that cannot be undone afterwards.
- Re-check after major updates. Defaults change, new features arrive switched on, and terms are revised. An annual look is proportionate.
- Do not rely on this page for specifics. Policies differ and change; what belongs on a durable page is the method, not a table of company names that would be wrong within months.
People are typing things into these systems that they have never told another human being — medical worries, marital problems, money trouble, doubts about their own competence. That is not foolish; it is what happens when something answers patiently at three in the morning. But it means the honest privacy question is not the legal one. It is: would you be comfortable if this specific conversation were read by a stranger at that company? If not, that is the conversation to have with a person instead.Related: AI companions and what the research shows (published 22 Aug 2026)
Before typing something personal, ask whether you would be comfortable with a stranger at that company reading it; if not, have that conversation with a person.
The industry has been better about disclosure here than it is usually given credit for — most of this is written down, if rarely read. The genuine problem is defaults: the privacy-protective option is frequently the one you have to go and find, on the tier used by the people least likely to look. That is a design decision, not an accident, and it is the fair thing to criticise.