Are Your Secrets Safe with AI?

November 6, 2026 · By Torch Ignited Academy

A lot of people believe that anything they type into AI gets fed back into the model and could end up in someone else's answer later. It's one of the most common concerns we hear, and it keeps some people from using AI at all. The worry isn't unfounded, but for most businesses, the risk is smaller and easier to manage than people expect.

Where the myth comes from

The myth didn't come from nowhere. Free and personal AI plans have generally used conversations to improve their models unless you change the setting. In August 2025, Anthropic updated its consumer terms so personal Claude accounts could be used for training, with chats kept for up to 5 years when that setting is enabled. Google's Gemini Apps Privacy Hub openly tells people not to enter confidential information, because some chats on personal accounts are read by human reviewers.

So if you're using a free account with the default settings, your chats may be used for training. Business plans, and personal accounts with training turned off, are handled differently.

What "training" actually means

When people picture AI training, they often imagine the model reading their message, learning it on the spot, and repeating it to the next person who asks. That isn't how it works.

The model you're chatting with doesn't change during your conversation. Training happens later, when a company gathers large batches of data and uses them to build or refine a future version of its model. OpenAI says it takes steps to reduce the amount of personal information in its training data before using it. That doesn't remove all risk, so sensitive information still deserves care.

It also helps to separate training from "memory" features. When ChatGPT or Claude remembers that you like short answers, that's a personalization feature tied to your account. It isn't the same thing as your chats being used to train the model.

What the major tools actually say

Here's how the 4 tools we get asked about most handle training today. The pattern is pretty consistent: personal plans can be used for training, and business plans aren't by default.

One important note: paying for a plan doesn't automatically make it a business plan. A ChatGPT Plus or Claude Pro subscription is still a personal account, even if your company covers the bill.

These policies also change. Anthropic's 2025 update is a good example of why it's worth checking every so often. Everything in this article was checked on November 4, 2026.

The fine print worth knowing

Turning training off covers most of the risk, but there are a few details that catch people by surprise.

• Thumbs up and thumbs down count. OpenAI says that if you rate a response, the entire conversation tied to that rating may be used for training, even if you've disabled training. Claude's terms make a similar exception for feedback.
• Turning training off isn't retroactive. The setting applies to new conversations going forward. Anything already used for training stays that way.
• "Not used for training" doesn't mean "not stored." Even with training off, Claude keeps chats for 30 days and Gemini keeps them for 72 hours so the service can run and catch abuse. Gemini chats that a human reviewer has seen can be kept for up to 3 years.
• Connected apps count too. If you connect Gmail or Google Drive to a personal Gemini account, the information Gemini pulls from them falls under the same personal-account rules.

Training is only one question

The training question gets the most attention, but it's only part of the picture. Even on a business plan where nothing is used for training, it's worth asking a few more things about the tool your team uses:

• How long is it kept? Ask how long uploaded files, chats, and results stay available, and whether you can delete them.
• Who can see it? Think about your own admins, the provider's staff, and any connected apps.
• What happens to the results? A summary of a confidential proposal is still confidential, so it needs the same care as the original.

A good answer to one of these shouldn't be treated as the answer to the others. "We don't train on your data" and "only your team can see your data" are 2 different promises.

A 5-minute check you can do this week

You don't need to be a security expert to get this under control. Here's a quick check you can run today.

1. List the AI tools your team actually uses. Include the free accounts people may have set up on their own.
2. Check the plan for each tool. Personal or business makes the biggest difference.
3. Review the training setting on personal accounts. In ChatGPT, it's under Data Controls. In Claude, it's under Privacy. In Gemini, it's the Keep Activity setting.
4. Set a simple rule for confidential information. Client files, financials, and employee details belong in a business plan your company controls. Temporary or incognito chats help, but they're a stopgap rather than a policy.
5. Write it down. A short paragraph that says which tools are approved and what shouldn't go into them gives your team something clear to follow.

If you'd like to test a new AI workflow before using real information, try it with sample data in the same format and see how useful the results are.

The bottom line

Not everything you type into AI is used for training. Some of it can be, if you're on a personal plan with the default settings, and that's worth taking seriously. The good news is that most of it is in your control. Once you know which plan you're on and how your settings are configured, you can use these tools with more confidence.

Have questions about the tools your team uses? Ask us on the Torch Ignited Academy forum, and we'll be glad to help.