Is It Safe to Upload Files to ChatGPT? Settings and What Never to Upload

By Alex Mercer · Last reviewed 2026-10-07

Is it safe to upload files to ChatGPT? It can be, for ordinary documents, once you have checked two settings: whether your chats can be used to train models and how long your data is kept. This guide compares those settings for ChatGPT, Claude and Gemini in plain language, based on each company's own help and privacy pages as of 7 October 2026, and lists the files you should keep out of any chatbot. It is general information, not legal advice.

Before you start: what you need

• Know which plan you are on. Consumer plans (free and paid personal) and business plans have different data terms. A work account provided by your employer usually follows the employer's contract.
• Know your obligations. If the file contains other people's personal data, laws such as the GDPR in the UK and EU, client confidentiality duties or an NDA may apply regardless of the tool's settings.
• Five minutes in settings. Every check below is a toggle or a page you can read.

Step-by-step: is it safe to upload files to ChatGPT for your situation?

1. Classify the file. Public or harmless (a published article, your own draft), internal (a business plan), or sensitive (client records, ID, health, finance). Sensitive files need a business plan with suitable terms, or should stay out.
2. Check training. Switch off training on your data if you are on a consumer plan and don't want to contribute.
3. Check retention. Know how long deleted chats and files stay on the provider's systems.
4. Strip what isn't needed. Remove names, account numbers and signatures before uploading. Often you only need the structure or the text.
5. Delete when done. Delete the chat (and in ChatGPT, any saved Library copy of the file) once you have what you need.

Example: settings checklist per tool

ChatGPT

• Training: In Data controls, switching off "Improve the model for everyone" means new conversations won't be used to train OpenAI models. They still appear in your history.
• Temporary Chat: Temporary chats don't appear in history, don't create or update memories, aren't used to improve models, and may be kept for up to 30 days for safety purposes. If you save one, it becomes a normal chat under your usual settings.
• Deleted chats and files: OpenAI says deleted chats are scheduled for permanent deletion within 30 days, unless already de-identified or kept for security or legal reasons. Files in a deleted chat follow the same 30-day schedule, but a copy saved in Library stays until you delete it there too.
• Business plans: OpenAI says data from ChatGPT Business, Enterprise and Edu, and the API, isn't used for training by default.

If you organise client work in ChatGPT Projects, the same settings apply to files you add to a project.

Claude

• Training choice: Claude Free, Pro and Max users choose in Privacy Settings whether chats and coding sessions can be used to improve Claude. You can change the choice at any time; it applies to new or resumed chats.
• Retention: Anthropic says data is kept for 30 days if you don't allow training, and up to five years if you do.
• Deleting: Anthropic says a conversation you delete won't be used for future model training.
• Commercial plans: Claude for Work, Claude for Government, Claude for Education and API use are not covered by the consumer setting and follow commercial terms.

Gemini

• Keep Activity: With Keep Activity on, chats and what you share (files, photos, screens) are saved to your activity, and Google's default auto-delete is 18 months (you can choose 3 or 36 months, or off).
• Human review: Google says a subset of chats is reviewed by human reviewers, including trained service providers. Reviewed chats are disconnected from your account and kept for up to three years, even if you delete your activity.
• With Keep Activity off: Future chats are still kept for 72 hours so Gemini can respond and for safety.
• Google's own warning: "Please don't enter confidential information that you wouldn't want a reviewer to see or Google to use to improve our services."
• Work or school accounts: Google says these may have different data handling terms.

Mistakes to avoid

Data controls

• Assuming paid means private. A paid personal plan is still a consumer plan. Check the training setting.
• Forgetting old chats. Changing a setting usually affects new chats. Delete old ones that held sensitive files.
• Leaving files in Library. In ChatGPT, deleting a chat doesn't remove a file saved to Library.
• Sharing project or chat links carelessly. A link can travel further than you intended.

GDPR

If you are in the UK or EU and the file contains personal data about customers, staff or clients, you are usually the party responsible for that data. Uploading it to a consumer AI account may not fit your privacy notice or your lawful basis. Use an approved business tool, remove personal data first, or ask your data protection lead.

What never to upload

Keep these out of any consumer chatbot, whatever the settings:

• passwords, API keys, recovery codes and two-factor backup codes,
• passport, driving licence or national ID scans,
• full bank, card or payroll details,
• medical records and health information about other people,
• client files covered by professional confidentiality, unless your firm has approved the tool and terms,
• anything under an NDA or marked confidential by someone else,
• student records or children's personal data.

When not to use AI for this

Skip the chatbot if the only way to get value is to upload the sensitive part. If you need a contract clause reviewed, paste the clause with names removed rather than the whole signed contract. If your employer or regulator hasn't approved AI tools for client data, ask first. For profession-specific red lines, see our hub on AI tools by profession, and lawyers should read AI for small law firms.

FAQ

Does ChatGPT train on my files?

On personal plans it can, unless you switch off "Improve the model for everyone" in Data controls or use a Temporary Chat. OpenAI says Business, Enterprise and Edu data is not used for training by default.

How do I turn off AI training on my data?

In ChatGPT, switch off "Improve the model for everyone" in Data controls. In Claude, change the model-improvement choice in Privacy Settings. In Gemini Apps, turn off Keep Activity, which also stops future chats being reviewed to improve Google services.

Is Claude private?

Claude Free, Pro and Max users choose whether chats are used for model training; Anthropic retains data for 30 days if you decline and up to five years if you allow it. Commercial plans such as Claude for Work and the API are covered by separate terms.

Conclusion

Open your assistant's settings now, switch off training if you don't want to contribute, and decide which of your files belong on the never-upload list. For anything involving clients' personal data, move that work to a business plan with written data terms or keep it out of AI entirely.

Sources and methodology

Desk research from official vendor help and privacy pages, last reviewed 2026-10-07. Policies change; re-check before relying on them.

• OpenAI, Data controls in ChatGPT: https://help.openai.com/en/articles/7730893-data-controls-in-chatgpt
• OpenAI, Temporary Chat FAQ: https://help.openai.com/en/articles/8914046-temporary-chat-faq
• OpenAI, Chat and file retention in ChatGPT: https://help.openai.com/en/articles/8983778-chat-and-file-retention-policies-in-chatgpt
• OpenAI, Enterprise privacy: https://openai.com/enterprise-privacy/
• Anthropic, Updates to Consumer Terms and Privacy Policy: https://www.anthropic.com/news/updates-to-our-consumer-terms
• Google, Gemini Apps Privacy Hub: https://support.google.com/gemini/answer/13594961