Most people discover this the uncomfortable way. You paste an unpublished chapter, or a client contract, or a medical question you would not ask out loud, and afterwards it occurs to you that you have no idea what just happened to it.
The answer, for most consumer AI tools, is: it was transmitted to a server, stored, possibly retained for months, possibly reviewed by a human for safety or quality, and possibly used to train the next model — depending on the provider, your plan, and settings you may never have opened.
That is fixable, mostly. Here is what actually helps, ordered by how much difference it makes.
Fix 1: Turn off training on your data
This is the single highest-value setting and it is off by default on many consumer plans — meaning your chats are on by default for training.
Go into your AI tool’s settings and look under Privacy, Data Controls, or Improve the model. There is usually a toggle governing whether your conversations can be used to improve the service. Turn it off.
Two things to know. First, on some services this toggle is coupled to chat history — switching it off also disables saved conversations. That is an annoying trade, but if the content is sensitive it is the right one. Second, it is usually not retroactive. Anything sent before you flipped it may already be in a training set.
Check this on every AI tool you use, not just the main one.
Fix 2: Use an incognito or temporary chat mode
Most serious tools now offer a mode where the conversation is not saved to your history and not used for training. It goes by different names — temporary chat, incognito, private mode.
Use it as the default for anything you would not want stored: unpublished creative work, client material, health and legal questions, anything involving other people’s information.
Platforms that treat privacy as a core feature rather than a settings-page afterthought make this easier. XPT, for example, offers an incognito mode with no logging and no training use, and markets itself explicitly on private AI chat with user-controlled retention. Where a tool puts the private mode is a reasonable signal of how seriously it takes the feature — one click away is a different product decision from four menus deep.
Whichever tool you use, remember what an incognito mode does and does not mean. It means the provider states it is not retaining or training on that session. It does not mean the message never left your machine — it still travelled to a server to be processed.
Fix 3: Delete your history, and understand the lag
Deleting conversations is worth doing, but read the policy. Most providers hold deleted data for a period — commonly around 30 days — before purging, and some retain material flagged for safety review for longer. Deletion is a request with a queue behind it, not an erase.
If your account holds two years of chats, export what you want and clear the rest. A stored history is a target for anyone who gets into your account.
Fix 4: Secure the account, because that is the realistic threat
The dramatic risk people worry about is a provider misusing their data. The boring risk that actually happens is someone getting into their account.
- Turn on two-factor authentication. This is the highest-value thirty seconds in this whole article.
- Use a unique password from a password manager.
- Check the active sessions list and log out anything you do not recognise.
- On shared or work machines, log out rather than staying signed in.
Your chat history is a diary. Treat the account like one.
Fix 5: Redact before you paste, every time
No provider setting protects information you never had to send in the first place. This is the habit that matters most, and it is entirely within your control.
Before pasting, strip what the model does not need to do the job:
- Real names → placeholders. “Client A”, “Person 1”.
- Account numbers, ID numbers, addresses, phone numbers → remove entirely.
- Company names in sensitive contexts → generic descriptors.
- Credentials, API keys, passwords → never, under any circumstances. If one goes in, rotate it immediately; assume it is compromised.
- Other people’s medical, financial or legal details → they did not consent to this.
The model almost never needs the identifying detail to give you a useful answer. “Review this contract clause” works exactly as well without the parties’ names in it.
Fix 6: Match the tool to the sensitivity
Not everything needs the same level of care. A rough tiering that works:
- Public or low-stakes — brainstorming, general questions, published material. Any tool, default settings.
- Private but not dangerous — unpublished writing, personal journaling, career questions. Training off, incognito mode on.
- Genuinely sensitive — client confidential material, health details, legal matters, anything covered by a professional duty. Redact heavily, incognito mode, and check whether you are contractually allowed to use a third-party AI service at all.
- Regulated or truly confidential — patient records, privileged legal work, trade secrets under NDA. Do not put it into a consumer AI service. This needs an enterprise agreement with contractual data terms, or a locally-run model.
Most privacy incidents come from treating tier-four material as tier-one.
Fix 7: Consider running a model locally
For maximum privacy, the answer is that nothing leaves your machine. Open-weight models running locally are now genuinely usable on consumer hardware for many tasks.
The trade is real: local models are less capable than frontier cloud models, setup takes an afternoon, and you need decent hardware. But for a specific category of work — anything you truly cannot let touch a third-party server — it is the only complete answer.
What no setting fixes
Be clear about the limits, because privacy pages tend to blur them.
Every claim is a policy, not a proof. “We don’t log” is a commitment a company makes and can change, and you generally cannot verify it from outside. Read the actual privacy policy rather than the marketing headline, and prefer providers who are specific about retention periods.
Legal process overrides settings. Data a provider holds can be compelled by a court regardless of what your toggles say.
Breaches happen. Data that exists can leak. Data you never sent cannot. This is why redaction beats every setting.
The short version
Turn off training use. Use incognito mode by default for anything private. Clear old history. Turn on 2FA. And redact before you paste — that one habit does more than every toggle combined, because it is the only fix that does not depend on a company keeping its word.
