Is ChatGPT Safe? What It Keeps, Who Can See It and What Not to Tell It

Yes, for anything you wouldn't mind someone else reading. ChatGPT is a mainstream service with real security, but it isn't private: OpenAI keeps your chats until you delete them, can train on them unless you turn that off, and staff, courts and work admins can reach some of them.^{1, 2} So whether it's safe depends less on ChatGPT than on what you put in it.

The risk sits in the details more than the subject. Asking what a lab result usually means, or how a lease break clause usually works, is often a good use of ChatGPT. The harm comes from your name next to a diagnosis, an account number, or a client's file. The sections below sort out which details belong in a chat and which don't.

Is ChatGPT safe to use?

As a service, mostly yes. OpenAI gives you real controls, and it has had two limited security incidents, one in its own systems and one at a vendor. But "safe" covers four separate questions, and the answer depends on which one you're asking.

The four are:

• Privacy: who can read a chat, and how long it stays.
• Account security: your password, shared links, connected apps and fake apps.
• Accuracy: wrong answers delivered with confidence.
• People: teens and scams.

Most "is ChatGPT safe" advice blurs these together, which is why it usually ends in a vague warning.

OpenAI deserves credit for several controls, and many readers should simply use them:

• Temporary Chat. It keeps a conversation out of your history, isn't used for training while it stays temporary, and creates no new memories.³
• A training switch. You can turn off training under Settings > Data controls.²
• Deletion. A deleted chat is scheduled for permanent deletion within 30 days, with stated exceptions.¹
• Multi-factor authentication (MFA). It covers all OpenAI services and works with an authenticator app, push approval, SMS or WhatsApp codes, or a passkey.⁴
• A warrant requirement. In the US, OpenAI requires a valid warrant or equivalent before giving chat content to law enforcement.⁵
• Limited ads. Plus and higher plans show no ads, and neither does Temporary Chat.⁶ On Free and Go, ads are chosen partly from your current chat, and OpenAI says it doesn't share conversations with advertisers or sell data to them.

Is it private? Not in the usual sense. OpenAI's pages describe encryption in transit and at rest, not end-to-end encryption.⁷ For more on what OpenAI saves and shares, see a fuller look at whether ChatGPT is private.

None of that changes the core limit: OpenAI keeps your chats, some people can reach them, and you decide what goes in. ChatGPT is safe to use. It is not a safe place to keep a secret.

What does ChatGPT keep, and for how long?

Your saved chats stay until you delete them. Several other things (memories, Library files, shared links) outlast the chat that created them. A deleted chat is scheduled for permanent deletion within 30 days, with exceptions.

The table below shows what OpenAI's own pages and the court record say about each kind of data:

The de-identified exception is tied to training. OpenAI's privacy policy links it to chats already disassociated from your account when you let OpenAI use your content to improve its models, so your training setting affects what deletion can reach.⁸ The policy also says content or accounts banned for policy violations may be kept longer. For a dated record of how these rules have changed, see the ChatGPT privacy timeline.

Who can read your ChatGPT chats?

More people than the word "chat" suggests, though most need a stated reason or a legal step. Here they are, by name and reason:

• OpenAI staff and contractors. A limited number of authorized people may access content to investigate abuse or a security incident, to give support you ask for, to handle legal matters, or to improve model performance unless you opted out. OpenAI says it monitors and logs that access.¹²
• Reviewers of flagged chats. Trained personnel assess flagged conversations in context. OpenAI notifies law enforcement when a conversation indicates "an imminent and credible risk of harm to others."¹³ How AI providers handle police reports covers the details.
• Police and government agencies. In the US, OpenAI needs a warrant or equivalent for content and a subpoena or court order for non-content data. It may disclose in emergencies involving danger of death or serious injury, and it gives the user notice unless the law prohibits it.⁵ From July through December 2025, it reported 75 content requests, 224 non-content requests and 10 emergency requests.¹⁴
• Civil courts. In the New York Times lawsuit against OpenAI, a magistrate judge ordered OpenAI on May 13, 2025 to preserve output logs that would otherwise be deleted. On January 5, 2026, the district judge affirmed orders to produce 20 million de-identified consumer logs to the plaintiffs.^{15, 16}
• Your employer. On a managed work account, admins can access and export your content.¹⁷ The work section below explains when a personal account can come under an admin.
• Anyone with a shared link. Personal-account links open for anyone who has them, with no per-person permissions and no expiry date.¹⁰
• Apps you connect. They can see context from your chats and memories, plus your IP address and approximate location, and they handle that data under their own policies.¹⁸

In the January 2026 ruling, the judge compared ChatGPT conversations with wiretapped phone calls:

privacy interests in the wiretapped recordings of private phone conversations in Rajaratnam are stronger than the privacy interests in users' conversations with ChatGPT which users voluntarily disclosed to OpenAI and which OpenAI retains in the normal course of its business.

That was one ruling in one discovery dispute. Still, it shows how a chat you typed alone can become material in someone else's case. Parents are not on this list: a linked parent account can't read a teen's chats, as the teens section explains.

What does ChatGPT know about me?

It knows what you tell it, plus what it can pull in: saved memories, your past chats when Reference chat history is on, and any apps you connect. OpenAI describes memory as something that "references all your past conversations," and says "New conversations build upon what it already knows about you."¹⁹

Reference chat history has no separate storage limit, and what ChatGPT draws from it can change as it updates what it finds most useful.⁹ Since June 2026, memories update automatically, with twice the capacity on Plus and Pro, and once Gmail, Google Calendar and Google Contacts are connected, ChatGPT "will automatically reference them when relevant."²⁰

With Memory on, it may also remember information it reads in a connected app.¹⁸ Beyond what you give it, OpenAI's privacy policy lists data it receives from security and safety partners, from advertisers and "other data partners" (for example, purchases you make from those advertisers), and publicly available web data used to develop its models.⁸

People had good reason to worry about what Apple and Facebook held. In the 2014 theft of celebrity photos, the Justice Department described phishing schemes that tricked people into handing over their usernames and passwords.²¹ Apple said none of the cases came from a breach of its systems.²² The photos came out of individual accounts that people had filled with private material, which is why account security mattered.

Cambridge Analytica was about inference. The UK Information Commissioner's Office reported that data from up to 87 million Facebook users, by Facebook's own estimate, was harvested.²³ Combined with the pages a person had liked, that data was used to build a model that could predict how the person was likely to vote.

Those cases involved photos, likes and profile data. A ChatGPT history can hold private thoughts, health worries, relationships, money and doubts, written in a person's own words. With memory and connected apps, all of it sits with one company. What a social network inferred from your likes, a chat history can hold in your own words.

Meta's privacy policy describes what Facebook collects from what you do and share, including your posts, photos and likes, your location, the ads you interact with, and activity on other sites and apps that partners send it.²⁴ The figure below sets that beside what a ChatGPT history can hold.

That concentration is a reason to think carefully, not to panic. A UN Special Rapporteur's report on freedom of thought, drawing on the UN Human Rights Committee, treats "mental privacy" as "a core attribute of freedom of thought."²⁵ A chat history comes close to a written record of thinking. A company that can read that record can also report from it, which is how some chats reach the police.

OpenAI built memory to be useful, and it lets you see and trim what it holds:

• Manage or delete saved memories in Settings > Personalization > Memory. The memory summary there is a high-level view that may omit details.⁹
• Turn off Reference chat history. What was remembered from past chats is then scheduled for deletion within 30 days, while the chats themselves stay.
• Disconnect apps you no longer use. That stops future access but doesn't delete past chats that already used them.
• Use Temporary Chat when you don't want a conversation to create new memories.³

Should I be careful what I tell ChatGPT?

Yes, and mostly about details rather than subjects. OpenAI's own advice, quoted above, is to leave out anything you wouldn't want reviewed or used.¹²

The common version of this advice is to treat every chat as if it were public. I think that fails as guidance, because nobody follows it and it scares people away from good uses. People already decide what to share by thinking about who might hear it. With ChatGPT, you don't get to pick.

A chat might be read by a reviewer acting for one of OpenAI's four reasons, a court, a work admin, someone holding a shared link, or someone who takes over your account. The figure below sorts what you include by what would happen if someone you didn't choose read it.

The risk is the identifying detail, not the subject. "How does a lease break clause usually work?" teaches you something and exposes nothing. Paste in the lease with your name, your landlord's name and the address, and the same question now carries everything a reader would need.

So ask in general terms and strip names, account numbers and records. When the specifics have to go in, use an app the company can't read, or take it to a professional.

What should you never tell ChatGPT?

Anything someone could use directly: credentials, codes, and the numbers that identify you or open your accounts. These belong in no AI chat, because whoever reads them can act on them.

• Passwords: whoever reads one can sign in as you, and a reused password opens more than one account.
• One-time and recovery codes: they get past the second step that protects your accounts. OpenAI says it "does not request passwords, API keys, or verification codes through email, text, or chat."²⁶
• API keys and other secrets (tokens, private keys, connection strings): they grant access to paid services and systems, often with no second factor.
• Social Security, passport and driver's license numbers: they help someone open accounts in your name, and you can't easily change them.
• Full card and bank account numbers: someone could use them to charge you or move your money.

Other people's confidential records, and the identifying details of your own health, legal or money matters, belong in the figure's third tier: ask in general terms and leave the details out.

Is ChatGPT safe from hackers?

OpenAI has had two limited incidents, one in its own systems and one at an analytics vendor. The bigger practical risk is someone getting into your account, where one password can open your whole chat history.

In March 2023, a bug in the open-source redis-py library let some users see titles from other active users' chat histories, possibly including the first message of a new chat.²⁷ The same bug may have shown payment details for 1.2% of Plus subscribers who were active during a nine-hour window. OpenAI says full card numbers were never exposed.

In November 2025, an attacker got into Mixpanel, an analytics vendor OpenAI used.²⁶ OpenAI says "This was not a breach of OpenAI's systems" and that chats were not affected. It flagged the exposed names, emails and coarse locations as a phishing risk, and it has stopped using Mixpanel.

Turn on multi-factor authentication or a passkey. For more protection, Advanced Account Security limits sign-in to passkeys and security keys, turns off password sign-in and email or SMS codes, and stops training on your chats while it's on.²⁸ The trade-off: if you lose every sign-in method and recovery key, you may lose the account.

If you think someone got in, take these steps:

1. Change your password, or the Google or Microsoft password you sign in with. Current sessions are logged out within 30 minutes.²⁹
2. Use "Log out of all devices" in Active sessions, which can take up to 30 minutes.³⁰ Then turn on MFA; turning on MFA alone doesn't end existing logins.⁴
3. Report it through OpenAI's Fraudulent Activity webform and choose "Report unauthorized activity involving my account."³¹

Get the app from the links on OpenAI's download page, and check that the listed developer is OpenAI.³² Real shared conversation links begin with https://chatgpt.com/share/, so treat anything else as suspect.¹⁰

Agent mode, browsing and connected apps add one more risk: prompt injection, where content ChatGPT reads carries hidden instructions. OpenAI calls it "a frontier, challenging research problem" and advises limiting an agent's access to only the sensitive data or credentials the task needs.³³

How often is ChatGPT wrong?

No primary source gives a single error rate, so any page that quotes one is guessing. OpenAI's own product page and terms both say it can be wrong.

The chatgpt.com page says "ChatGPT is AI and can make mistakes."³⁴ OpenAI's Terms of Use put it more strongly, and the wording makes accuracy a safety question:³⁵

Output may not always be accurate. You should not rely on Output from our Services as a sole source of truth or factual information, or as a substitute for professional advice.

OpenAI defines hallucinations as "plausible but false statements generated by language models." Its research argues that standard training and evaluation reward guessing over admitting uncertainty.³⁶ Its help page lists fabricated quotes, studies, citations and references to sources that don't exist among the errors to watch for.³⁷

NIST's generative AI profile calls the same problem confabulation. It places the risk where harm happens: when people believe confident but false content and act on it.³⁸ So check anything you'll act on, especially medical, legal and financial answers, and open the sources ChatGPT cites before relying on them.

Is ChatGPT safe to use at work?

On a work account your employer manages, assume your admin can see what you type. On a personal account the chats are yours, with one exception explained below. Separately, your employer can monitor a work laptop or network no matter which account you use.

OpenAI says the admin of a managed account "may be able to access, export, audit, retain, delete" your prompts, files and outputs, and can see usage metadata such as sign-ins and devices.¹⁷ You manage a personal workspace yourself. But if you signed up with a work email and your organization later verifies or claims that domain, the admin may gain the same access. OpenAI's advice is to keep personal use on a personal account and confirm which account you're in before starting a chat.

Training and admin access differ by plan:

Some work data carries legal duties. A business associate agreement (BAA) is the contract HIPAA uses for vendors that handle patients' health information. OpenAI offers BAAs only for the API and certain business plans (sales-managed Enterprise or Edu, plus a separate flow for ChatGPT for Clinicians), not for ChatGPT Business or personal accounts.⁴⁰ If you handle client or patient information, read this guide to using AI safely in a therapy practice before pasting anything in.

Is ChatGPT safe for kids and teens?

OpenAI's terms set the minimum age at 13 and require a parent's or guardian's permission for users under 18.³⁵ Parental controls, launched on September 29, 2025, adjust what teens get without exposing their chats, and OpenAI says its guardrails "can be bypassed if someone is intentionally trying to get around them."⁴¹ So teach the never-tell list and the detail rule above directly; settings won't cover that part.

A parent links accounts with the teen and can turn off training on the teen's conversations, but linking doesn't let them read the teen's chats or history.⁴² Specially trained reviewers evaluate serious self-harm and disordered-eating concerns before a safety notification goes out, and the notification doesn't include the conversation.

How do you use ChatGPT more safely?

Use the controls OpenAI offers, then check the few settings that quietly undo them. The basics take a few minutes:

1. Turn off "Improve the model for everyone" under Settings > Data controls. The change applies to new conversations.²
2. Use Temporary Chat for anything you don't want in your history or memory. It limits exposure but doesn't make a chat private: OpenAI may keep a copy for up to 30 days for safety.³
3. Delete chats you no longer need, and delete memories and Library files separately.
4. Turn on MFA or a passkey, and check Security history and Active sessions from time to time.
5. Keep work and personal use in separate accounts.

Settings that quietly undo the safe ones

Each of these can reverse a choice you thought you had made:

• A thumbs up or down can send the whole conversation into training, even with training off. In OpenAI's words: "If you choose to provide feedback, the entire conversation associated with that feedback may be used to train our models."²
• Saving a Temporary Chat turns it into a regular chat, and your normal training setting then applies.³
• Voice mode has its own training control, separate from the main switch.³⁹
• On Free, Plus, Go and Pro, information ChatGPT reads in connected apps can be used for training when the training setting is on.¹⁸
• Deleting a chat doesn't delete a memory made from it or a file saved to Library.^{9, 1}
• Turning training off doesn't delete existing chats or shared links, and it doesn't change who can open those links.¹⁰

Network-level steps, such as a VPN, an email alias or how you pay, are a separate layer; this guide to using AI privately covers them. If you're thinking about linking a bank account, read the guide to connecting a bank account to AI first.

When should you use something else?

Use something else when the identifying details have to go in and you don't want any company able to read them. No ChatGPT setting removes the access described above, so the answer is a different arrangement rather than a different toggle.

The main options:

• A professional (doctor, lawyer, accountant or therapist), when a person's judgment and duty of confidentiality matter more than speed.
• A business plan with contractual terms, for work data your employer is responsible for.
• A local model on your own hardware. The chat stays on your machine, but you run and maintain it yourself and are limited to the models your hardware can handle.
• A service built so the operator can't read chats. This list of private AI chat apps compares several.

Maple is one of those services, and it's ours. We built it so no one at Maple can read your chats, and you can check how it works on our proof page. We don't train on your conversations.

Privacy is only half of what we offer; the other half is the models. We offer capable open models you can use without buying or running the hardware a local setup needs, and our model library lists them. Capability varies by model and task, so pick the model that fits the work.

There are limits. You still rely on the hardware behind each enclave, the published code and our signing key. We don't offer a BAA yet, and we haven't been audited; we're working toward a BAA and a SOC 2 audit. The accuracy advice above applies to every model, ours included.

Sources

1. OpenAI, Chat and file retention in ChatGPT. Saved and archived chats kept until deleted; the 30-day deletion rule and its exceptions; Library files.
2. OpenAI, How your data is used to improve model performance. Training opt-out, new conversations only, feedback, and business and API defaults.
3. OpenAI, Temporary chat in ChatGPT. History, training, memory and the 30-day copy; saving a temporary chat.
4. OpenAI, Managing multi-factor authentication (MFA). MFA scope and methods; enabling MFA does not end other sessions.
5. OpenAI, OpenAI Government User Data Request Policy, January 1, 2026. Effective date; warrant for content, emergencies and user notice.
6. OpenAI, Ads in ChatGPT. Ads on Free and Go, none in Temporary Chat, no sharing with or selling to advertisers.
7. OpenAI, Security & privacy. Encryption at rest and in transit.
8. OpenAI, Privacy Policy, September 10, 2026. Temporary Chat and legal-hold retention, banned content, de-identified data and other data sources.
9. OpenAI, Memory in ChatGPT. Memory and chat-history behavior, controls and deletion.
10. OpenAI, Sharing conversations and scheduled tasks in ChatGPT. Who can open shared links, how long they last and how to recognize them.
11. U.S. District Court for the Southern District of New York, Stipulation and Order to Terminate OpenAI's Ongoing Obligations Under the Preservation Order, October 9, 2025. Obligation ended September 26, 2025; preserved logs still held except EEA, Swiss and UK users.
12. OpenAI, How OpenAI handles data in consumer services. Four reasons for staff access, access logging and OpenAI's advice on sensitive information.
13. OpenAI, Our commitment to community safety, April 28, 2026. Review of flagged chats and law enforcement notification.
14. OpenAI, Trust & transparency. Government request counts for July through December 2025.
15. U.S. District Court for the Southern District of New York, Order of Magistrate Judge Ona T. Wang (preservation order), May 13, 2025.
16. U.S. District Court for the Southern District of New York, Order of Judge Sidney H. Stein, January 5, 2026. Affirms production of 20 million de-identified logs; wiretap comparison.
17. OpenAI, Data access for your managed ChatGPT account. Admin access, domain claiming and personal-account advice.
18. OpenAI, Connected apps in ChatGPT. What apps can see, memory from apps and training on app data.
19. OpenAI, Memory and new controls for ChatGPT, February 13, 2024. Quotations from the April 10, 2025 update.
20. OpenAI, ChatGPT release notes. Automatic memory updates and automatic referencing of Gmail, Google Calendar and Google Contacts.
21. U.S. Attorney's Office, Central District of California (U.S. Department of Justice), Pennsylvania Man Charged with Hacking Apple and Google E-Mail Accounts Belonging to More Than 100 People, Mostly Celebrities, March 15, 2016. Phishing for usernames and passwords.
22. Apple, Apple Media Advisory, September 2, 2014. Apple's statement that no case resulted from a breach of its systems.
23. UK Information Commissioner's Office, Investigation into the use of data analytics in political campaigns: A report to Parliament, November 6, 2018. Up to 87 million users by Facebook's estimate; a model to predict voting.
24. Meta Platforms, Privacy Policy, July 23, 2026. What Facebook collects: activity and content you share, location, ads you view or interact with, and activity on other websites and apps from partners.
25. United Nations General Assembly, Interim report of the Special Rapporteur on freedom of religion or belief: Freedom of thought (A/76/380), October 5, 2021. Mental privacy and freedom of thought.
26. OpenAI, What to know about a recent Mixpanel security incident, November 26, 2025. Vendor incident, scope, and OpenAI's statement that it does not request passwords or codes.
27. OpenAI, March 20 ChatGPT outage: Here's what happened, March 24, 2023. The redis-py bug, chat titles and payment details.
28. OpenAI, Advanced Account Security. Sign-in requirements, training and the account-loss trade-off.
29. OpenAI, I'm seeing unrecognized activity on my OpenAI account. Password change and session logout.
30. OpenAI, Managing active sessions in ChatGPT. "Log out of all devices."
31. OpenAI, How can I report fraud or suspicious activity?. The Fraudulent Activity webform.
32. OpenAI, Download ChatGPT. Links to the official apps.
33. OpenAI, Understanding prompt injections: a frontier security challenge, November 7, 2025.
34. OpenAI, ChatGPT. The signed-out page's accuracy line.
35. OpenAI, Terms of Use, January 1, 2026. Effective date; accuracy clause and minimum age.
36. OpenAI, Why language models hallucinate, September 5, 2025.
37. OpenAI, Does ChatGPT tell the truth?. Fabricated quotes, studies and citations.
38. National Institute of Standards and Technology, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile (NIST AI 600-1), July 2024. Confabulation and the risk of acting on false content.
39. OpenAI, Data controls in ChatGPT. Training on by default for Free, Plus and Pro; separate voice control.
40. OpenAI, How can I get a Business Associate Agreement (BAA) with OpenAI for the API Services?. Which products are eligible for a BAA.
41. OpenAI, Introducing parental controls, September 29, 2025. Launch and OpenAI's statement that guardrails can be bypassed.
42. OpenAI, Managing parental controls in ChatGPT. What parents can and cannot see; how safety notifications are reviewed.