This is the question I get the second someone gets genuinely interested. Usually said quietly, a bit embarrassed, like it's a daft thing to ask: "…is it safe? Like — where does my stuff actually go?"
It's not a daft question. It's the most sensible one on this whole site.
🔐 What happens when you type something
When you hit send, your message goes to the company's servers, the model works on it, and the answer comes back. Mechanically, it's the same shape as every other cloud tool you already trust — your email, online banking, your accounting software. Your words aren't broadcast to the world.
But "it sits on their servers" does raise the one question that actually matters —
🎓 "Does it learn from my stuff?"
This is the real one. As of mid-2026, the big three all lean the same way on personal plans: your conversations can be used to help improve future models — unless you tell them not to. It varies by plan, and — importantly — the policies keep changing. (Claude didn't train on consumer chats at all until late 2025, then flipped its default.)
So don't bother memorising a rule that'll be out of date next month. Do this instead — about thirty seconds per tool. In ChatGPT: Settings → Data Controls → switch off "Improve the model for everyone". In Claude: Settings → Privacy → switch off "Help improve Claude". In Gemini: turn off "Keep Activity" (Google still holds new chats for up to 72 hours to run the service, but stops using them to improve its AI). Flick them off if you'd rather your chats weren't used that way.
🚫 What I never paste in
✗ Other people's details
Customer addresses, phone numbers, anything given to you in confidence. De-identify it first if you can.
✗ Passwords & bank details
Card numbers, logins, account numbers. Never. There's no reason to, ever.
✗ Anything under an NDA
If you've signed something promising to keep it private, that includes pasting it into an AI.
✗ Sensitive records
Health, legal, or financial details belonging to someone else. Treat them like you'd want yours treated.
✅ What's genuinely fine
Your own draft emails. General questions. "Explain this concept to me." Brainstorming. Summarising a document you already own. Your own marketing copy. The overwhelming majority of day-to-day work is completely fine — the careful list above is the exception, not the rule.
🏢 If you handle client work
Look at the business or "Team" plans. They typically come with a written commitment not to train on your data, plus tighter handling — which is exactly what you want if you're dealing with other people's information for a living. A small step up for real peace of mind.
One honest caveat: I'm not a lawyer, and this isn't legal advice. If you're in a regulated industry, check your own obligations. But for most small businesses the recipe is simple — turn off training, keep secrets out, use a business plan for client work — and you're being every bit as sensible with this as you already are with email.
Facts checked July 2026.