What Should You Share With ChatGPT and Claude

AI services are not public message boards. They are also not diaries, vaults, lawyers, doctors, or password managers. Your conversation may be stored, processed, reviewed in limited circumstances, connected to memory or tools, or affected by the settings and contract attached to your account.

Tamra's rule is easy to remember: be honest about the situation, vague about the identity, and never paste a secret.

These questions are related, but they are not interchangeable. Turning off training does not necessarily delete a chat. Deleting a chat does not necessarily remove a separate memory. Using a temporary mode does not protect data sent to a third-party connector.

The swap trick works surprisingly well. Replace “my bank, Chase, account 4417” with “my bank.” Replace a coworker's name and employer with “my manager.” Replace an exact patient record with a fictional, generalized example. The answer often gets just as useful while the exposure drops sharply.

Product labels change, so use the setting name as your anchor rather than relying on an old screenshot. In ChatGPT, review Improve the model for everyone, Memory, shared links, connected apps, and Temporary Chat. OpenAI says deleted chats are scheduled for permanent deletion within 30 days, subject to legal and security exceptions, and Temporary Chat may be retained for up to 30 days for safety. Read the current retention guidance.

In Claude, review Help improve Claude, Memory, Incognito chats, shared Projects, and connectors. Anthropic's consumer policy says users can choose whether new or resumed chats are used for model improvement; allowing that option can also bring a five-year retention period, while declining it keeps the usual 30-day period. Read Anthropic's policy update.

Neither product setting replaces account security. Turn on multi-factor authentication, use a unique password, remove unused connectors, review old shared links, and sign out of shared devices.

OpenAI and Anthropic treat API traffic differently from consumer chat products, with business controls and retention options that can be much stricter. But the API is only one part of the path. A third-party application may store your prompt, your own logs may retain it, and a leaked API key can create both a data and billing incident.

• Never paste an API key into chat, a screenshot, or a public repository.
• Set spending limits and alerting.
• Map every downstream vendor that receives prompts or files.
• Use least-privilege access for connectors and agents.
• Log enough to investigate failures without creating an unnecessary copy of sensitive content.

If a team uses AI for customer, employee, legal, health, or financial work, do not rely on informal advice. Write a short policy that answers five questions: which tools are approved, what data is allowed, what must be anonymized, who owns access, and how incidents are reported.

Business and enterprise plans can offer stronger contractual, administrative, and retention controls, but “business plan” is not a magic word. Confirm the actual terms, workspace configuration, access model, and regulatory obligations.

1. Turn on multi-factor authentication.
2. Review model-improvement and memory settings.
3. Delete old shared links and disconnect unused apps.
4. Remove sensitive details from custom instructions and saved memories.
5. Save the traffic-light rule somewhere your team will see it.
6. Use Temporary or Incognito modes for one-off sensitive topics, while remembering their limits.

AI is useful when it can understand the problem. It does not need every real name, account number, document header, or private secret to help you solve it. Start with the least sensitive version of the prompt, add detail only when it is necessary, and use an approved business environment when the stakes are higher.

Tamra's final check: If this conversation appeared with your name attached, would the consequences be acceptable? If not, rewrite it before you send.