Your Chatbot Can’t Keep a Secret — Can You?

Your chats with a consumer AI app are postcards. On most free and paid personal plans, they can train models, be read by human reviewers, and even survive the delete button and appear in court. Business plans use the same models, but different contracts. Five minutes in the settings fixes most of the issues.

The shredder and the chatbot

In my first days in private banking, a senior relationship manager gave me one rule before any other: A client name never leaves the bank. We had locked cabinets, clean-desk inspections, and a very busy shredder (it worked longer hours than a senior analyst).

Fast forward to last week. A friend — smart, successful, not a finance person — proudly showed me how she analyzed her portfolio. She had uploaded her portfolio statement, account number and all, to a chatbot, and asked whether her adviser was doing a good job. She did in thirty seconds what our compliance department spent decades preventing.

The answer was “rather good”, but that’s not what I was worried about. The chatbot had read her statement, and my question to her was “who else?”. And for how long? And in which country?

Those are not paranoid questions. They are the same questions any bank’s compliance officer asks before a single page leaves the building. Most people using AI chatbots do not ask these types of questions, and the honest answers depend heavily on which product they use and whether or not their employer is paying for it.

Your chat is a postcard, not a sealed letter

The simplest way to think about a consumer chatbot is a postcard that passes through many hands. The first hand is model training. AI companies improve their next models by learning from today’s conversations. Your words become raw material, and in some cases, human reviewers read samples to grade the answers. Here is where the major offerings stand today:

ChatGPT (OpenAI). On the Free, Plus and Pro plans, training is switched on by default. You can turn it off under Settings → Data Controls → “Improve the model for everyone,” but only future conversations are covered. Business, Enterprise, Edu and the developer API are excluded by default. (OpenAI)
Claude (Anthropic). Until August 2025, consumer chats were not used for training at all. Since then, Free, Pro and Max users must choose. Say yes, and your chats can be kept for up to five years; say no, and the 30-day retention stays. Business, government, education and API customers are excluded. (Anthropic) The pop-up for existing users arrived with the training switch already set to “On.” (TechCrunch)
Gemini (Google). A setting called Keep Activity is on by default. (DeleteMe) It saves your chats, uses them to train Google’s AI, and sends a sample to human reviewers. Reviewed chats are stored separately for up to three years — and survive even if you delete your history. (Google)
Grok (xAI). Training is on unless you switch it off, and there are separate switches for the Grok app, grok.com and Grok inside X. In some regions, people using Grok without logging in cannot opt out at all. (Robo Rhythms)
Meta AI (Muse Spark). Meta’s new Muse Spark model, launched in April 2026, runs the Meta AI app and requires a Facebook or Instagram login. Meta’s privacy policy places few limits on what it can do with your chats. (Axios)

On most consumer apps, paying $20 a month buys you a smarter model, not a more discreet one.

Deleted is not the same as gone

The second hand is retention: how long the postcard sits in the delivery chain. When you hit delete, most providers start a clock rather than reaching for the shredder. OpenAI normally removes deleted chats within 30 days. xAI promises the same for Grok, unless legal or safety reasons require longer. Google keeps Gemini chats for 72 hours even with history switched off, and by default stores your history for 18 months.

And then there are the lawsuits. In 2025, a New York court hearing the New York Times copyright case ordered OpenAI to preserve chats it would normally have deleted, including “temporary” ones. That order was lifted for most users that October, but a month later, the judge ordered OpenAI to hand roughly 20 million de-identified chat logs to the newspaper’s lawyers. The court noted this was a small slice of the tens of billions of logs OpenAI keeps.

In banking terms, that is a regulator freezing the shredder. Sam Altman, OpenAI’s chief executive, has been candid about the consequence. Talk to a doctor or lawyer and the law protects the conversation; talk to ChatGPT and, in a lawsuit, OpenAI could be compelled to produce it. He called that “very screwed up.” (TechCrunch)

The third hand is location. If you use a consumer app, you do not choose the country where your chats are stored. Choosing is a feature sold to companies. OpenAI, for example, lets eligible enterprise, education and developer customers store data in Europe, the UK, Japan, India and six other regions. At the other extreme, DeepSeek’s privacy policy states that it stores user data on servers in China. Italy banned the app, and South Korea halted downloads.

Location matters because data falls under the laws of the place it is stored. A Swiss bank account sits under Swiss law. A chat stored with an American provider sits under American courts.

Privacy is sold by the seat, not the subscription

The real dividing line is not free versus paid. It is personal versus business. A personal subscription upgrades the engine. A business account changes the contract, and the contract is what protects you.

	Free	Paid personal (Plus, Pro, Max, SuperGrok)	Team / Business	Enterprise
Your chats train future models by default?	Yes, at most providers	Yes, at most providers	No	No
Ads in or around your chats?	ChatGPT (US); Meta across its apps	ChatGPT’s $8 Go plan only	No	No
Who decides how long chats are kept?	The provider	The provider	Your administrator, within limits	Negotiated in the contract
Can you choose the country where data is stored?	No	No	Rarely	Often
What protects your data?	Terms of service	Terms of service	Business terms	Negotiated data agreement

The business column is remarkably consistent. OpenAI excludes Business and Enterprise data from training by default. (OpenAI) Anthropic does the same for Team, Enterprise and API customers. (Anthropic) Google promises that Gemini content in qualifying Workspace accounts is neither read by humans nor used for training outside your organization without permission. (Google) Even xAI launched Grok Business at $30 per seat in December 2025, with a pledge not to train on business data.

The ad column is a newer story. OpenAI began testing ads for Free and Go users in the US in February 2026; ads draw on the topic of your chat and your past conversations, though OpenAI says conversations are not shared with advertisers. Meta goes further. Since December 16, 2025, what you tell Meta AI shapes the ads and posts you see on Facebook and Instagram, with no opt-out outside the EU, UK and South Korea. Health, religion and politics are excluded. Google, for now, says Gemini chats are not used to show you ads. (Google)

The practical lesson for anyone with a job: if your employer provides a business AI account, use it for work. Your personal Plus subscription, however premium it feels, was never designed to hold a client file.

The “Share” button that means “Publish”

The most embarrassing leaks so far have not come from hackers. They came from users pressing a button.

In August 2025, Forbes found more than 370,000 Grok conversations indexed by Google. Some contained medical questions, business details and at least one password. Users had clicked “Share” to send a conversation to someone else — or to themselves — with no warning that the page would be public. OpenAI had run a similar, opt-in experiment shortly before. Over 4,500 shared ChatGPT chats landed in Google before the company pulled the feature. (Fortune)

Meta’s AI app went one step further with a public “Discover” feed. Users who thought they were saving a chat published it instead — among them, confessions of affairs, medical and legal questions, and tax records. (Android Authority)

A quieter version of the same problem is memory. Most chatbots now remember facts about you across conversations to be more helpful. Deleting a chat does not necessarily delete what the assistant learned from it; ChatGPT keeps a separate memory of details you have shared. That is convenient when it remembers your children’s names. It is less charming when it remembers your account balance.

The rule of thumb: treat every share link as a public web page, and check what your assistant has stored about you at least once.

The five-minute privacy check-up

None of this means you should stop using AI. It means you should use it the way you would use a helpful stranger on a train: happily, and without handing over your wallet.

Decide on training. ChatGPT: Settings → Data Controls → “Improve the model for everyone.” Claude: Settings → Privacy → “Help improve Claude.” Gemini: Gemini Apps Activity → “Keep Activity.” Grok: the training switch in Grok’s settings, and again in X under Privacy and safety. Meta AI offers no equivalent opt-out from ad personalization outside Europe and South Korea.
Redact before you paste. The chatbot does not need your account number to tell you whether a 1.5% fee is high. Replace names, account numbers, passport details and addresses with placeholders such as “Client A” or “Bank X.”
Use the incognito mode for sensitive one-offs. ChatGPT’s Temporary Chat, Gemini’s Temporary Chat and Grok’s Private Chat stay out of your history and out of training. They are still held briefly — 72 hours at Google, up to 30 days at xAI.
Treat “Share” as “Publish.” If you would not post it on LinkedIn, do not create a link to it.
Audit the memory. Once a quarter, open your assistant’s memory settings and delete anything you would not tell a new acquaintance.
Keep work on work accounts. If your employer offers a business AI tool, client and company information belongs there — never in your personal app. If it does not, ask why.

A room with walls

I did not lecture my friend (as an adviser, I know better than to lecture anyone over dinner). I asked her one question instead: would she have mailed that statement on a postcard?

Her question about the fees was a good one, and the chatbot helped. I just wish she had removed her name and account number before uploading the statement. The answer about her adviser’s fees, for the record, was right. She is now having that conversation with him — in person, in a room with walls.

My old mentor’s rule still holds. A client’s name never leaves the building. The difference today is that every building has a chat window, and most people have not noticed that it is open to the public.