Is ChatGPT Safe to Use? 7 Things You Should Never Share with AI

A chat interface with a padlock warning showing data leaving your device for OpenAI servers

Data flow diagram: your device to the internet to OpenAI servers, then stored, reviewed, and used for training

TL;DR: ChatGPT is safe for most everyday tasks, but it is not a private tool. What you type can be used to train future models, read by staff, or kept in logs. Seven things should never go into any public AI: passwords, ID numbers, confidential work documents, medical details, financial data, children's information, and other people's private data. For anything sensitive, use a local AI like Ollama.

Most people who use ChatGPT regularly have never thought about where their words go. You open the app, type, get an answer, close the tab. But that conversation didn't disappear, and what you typed matters more than you'd think.

ChatGPT is one of the most useful tools built in decades. It's also not private. Treating it like a notepad or an assistant who keeps secrets is a mistake with real consequences, from leaked work documents to identity theft to GDPR trouble.

This isn't about scaring you off AI. It's about using it with a clear head about what it does with your information.

So, is it safe?

Yes, for most things. ChatGPT is fine for explaining concepts, drafting emails, brainstorming, summarising articles, getting feedback on writing, and general research.

It's not safe as a container for sensitive information. The line is simple: it's safe to use, not safe to confide in.

What actually happens when you type

When you send a message to ChatGPT, four things follow: it leaves your device for OpenAI's servers immediately; it may be reviewed by staff to improve the system; by default it can be used to train future models (you can opt out in settings, but it's on by default); and it's stored for at least 30 days, sometimes longer. (OpenAI Data Controls FAQ)

None of this is unique to ChatGPT. The same goes for Claude, Gemini, Copilot, and nearly every public AI. So the right mental model is blunt: assume everything you type will be read by someone, someday.

The 7 things you should never share

1. Passwords, API keys, and credentials. This sounds obvious, yet it happens constantly. People paste code that still holds an API key, or include a password while asking for login help. Your credentials can end up in logs or training data, and if there's ever a breach, they're exposed. Before pasting anything technical, scan it and strip out keys, tokens, passwords, and connection strings.

2. Government ID numbers (passport, Aadhaar, SSN, PAN). These are the skeleton key of identity theft. With your ID number, name, and date of birth, someone can open accounts or file fraudulent returns in your name. There's almost never a real reason to type an ID number into an AI tool. If you think there is, there isn't.

3. Confidential work documents. This is where most AI-related professional leaks actually happen, not through hacking but through well-meaning employees. Someone pastes an internal strategy doc for a summary, or a client contract for a clause explanation, and it lands on a third-party server outside the company's control. Most employment contracts have confidentiality clauses, and industries like healthcare, legal, and finance have hard rules (GDPR, HIPAA, privilege) that make this a real legal risk. In 2023, Samsung engineers leaked proprietary chip code by pasting it into ChatGPT, and Samsung banned the tool internally. (BBC News) If a document is marked confidential or client-facing, keep it out of public AI and use a local model instead.

4. Medical information, yours or anyone's. Asking about a concept ("what does elevated cortisol mean?") is fine. The moment you add your name, a specific diagnosis, an NHS number, or a photo of a prescription, you've crossed into data that should stay private. Health information carries specific legal protections that public AI isn't built to honour. Understand concepts freely; never paste a personal report, lab result, or prescription.

5. Financial details. Account numbers, card details, loan numbers, portfolio data: none of it belongs in a public AI chat. "Explain how compound interest works" is harmless; "here's my bank statement, categorise my spending" is not. Financial data is the second most common identity-theft target after ID numbers, and even partial details plus your name can enable social engineering. Ask about concepts, never share the actual numbers.

6. Children's personal information. This has legal teeth. Under GDPR, COPPA, and similar laws, a child's data (name, age, school, photos, location) has protections most public AI tools don't meet. Beyond the legal risk, information shared about a child today can follow them for decades. Keep identifiable details about children out entirely.

7. Other people's private information, without consent. The easiest one to miss. You paste a colleague's message, a client's feedback, or someone's email to get help with a reply, and you never asked their permission. In Europe that's a GDPR issue, and everywhere it's a breach of trust. Anonymise first: replace names with "Person A," and strip emails, phone numbers, and other identifiers before you paste.

What to do when you need AI for sensitive work

You don't have to choose between AI and privacy. The answer is local AI.

Ollama is a free, open-source tool that runs AI models directly on your computer. Nothing leaves your device: no servers, no training data, no logs. Setup takes about 20 minutes and you get ChatGPT-style help for anything confidential.

Full guide: How to Run AI Locally on Your Laptop

A quick reference card

Pre-paste checklist: six questions to run before pasting anything into a public AI tool

Safe to share ✅	Never share ❌
General questions	Passwords or API keys
Fictional names and scenarios	Government ID numbers
Publicly available information	Confidential work documents
General medical concepts	Personal medical records
Financial concepts and formulas	Bank account or card details
Non-identifying project descriptions	Other people's private data
Code without secrets	Code with credentials in it

Practical checklist

Before pasting anything into a public AI:

A password, key, or token in there? Remove it.
A government ID number? Don't paste it at all.
Marked confidential at work? Use Ollama instead.
Someone else's name or details? Anonymise first.
Medical, legal, or financial data? Use Ollama for anything sensitive.
About a child? Strip all identifying details.

Any box ticked? Remove the sensitive part or switch to a local AI.

Key takeaways

ChatGPT is safe for general use, not as a private tool.
By default, what you type can be stored, reviewed, and used for training.
Seven categories should never go in: passwords, ID numbers, confidential work docs, medical data, financial details, children's information, and other people's private data without consent.
Opt out of training: Settings, Data Controls, "Improve the model for everyone," Off.
The Samsung leak shows this isn't theoretical.
For sensitive work, use Ollama: free, local, private, same capability.
When in doubt: anonymise, generalise, or don't paste it.

The bottom line

ChatGPT is genuinely one of the most useful tools around. The goal isn't to avoid it, it's to use it with judgment.

Most AI conversations are harmless: explaining a concept, drafting an email to a made-up recipient, debugging code with no secrets, summarising a public article. The line to draw is one question: does this contain real information about a real person? If yes, only share it if you'd be fine seeing it in a data breach, a training set, or a security audit.

Most of your AI work won't come near that line. The seven categories above are where people get into real trouble, usually not from malice but because nobody told them the line existed. Now you know.

Frequently Asked Questions

Can I opt out of training? Yes. Settings, Data Controls, "Improve the model for everyone," Off. That stops your chats being used to train future models, though they may still be retained in logs for safety.

Is Claude or Gemini safer than ChatGPT? Free tiers have similar policies: staff can review, and content may be used for improvement. Claude and Gemini offer Enterprise tiers with stronger isolation. For sensitive work, use local AI whichever you prefer.

Is ChatGPT GDPR compliant? OpenAI has taken steps toward compliance, but using a public tool with EU residents' personal data remains a legal grey area for businesses. When in doubt, consult legal and use local AI for personal data.

What is Ollama, and is it hard to set up? A free, open-source tool for running AI locally. Setup is about 20 minutes and needs no technical background. See the full guide.

My company uses Microsoft Copilot. Safer? Enterprise M365 Copilot keeps data in your Microsoft tenant and doesn't train on it, so it's generally safer for work documents than consumer ChatGPT. Confirm with your IT team.

What's Next

Best AI Tool for Your Job, by Role: which AI fits your profession, including data-sensitive roles
How to Run AI Locally on Your Laptop: a full walkthrough for private, local AI

Enjoyed this guide? Subscribe to the NeuralSutras newsletter for one practical AI lesson every Sunday, and follow our YouTube channel for step-by-step tutorials.

NeuralSutras. Practical AI for Everyone. Have a question or correction? We want to know: hello@neuralsutras.com