Privacy and account settings per assistant

The default settings of most assistants favour the company, not you. In five minutes you set that straight.

After this lesson you have: training off, shared links and memory cleaned up, and an account that can’t be opened with just a password.

Four switches that work independently

Switch	What it controls	What it does not control
Training	Whether your new chats may improve the model	Storage, abuse monitoring, and what’s already been trained
Temporary chat (incognito, private)	No history, no new memories, not used for training	The chat is still kept for a while
Memory	What the assistant remembers about you between chats	Deleting a chat doesn’t always erase memories along with it
Shared links	Who can read a conversation	Copies others have already saved

On top of that there’s your account: whoever gets in reads everything above. So a passkey or 2FA is a privacy setting too.

Per assistant

Where the training switch is, how long chats are kept and whether you can log in with a passkey or 2FA. Menus move around often; the date per row shows when we checked. Is a switch named slightly differently in your app? Search the settings for privacy, data or training.

Assistant	Turning off training	Retention	Passkey / 2FA	Checked
ChatGPTTraining on by default	Settings → Data controls → turn off Improve the model for everyoneAdvanced Account Security (passkeys or security keys only, plus single-use recovery keys) also excludes your chats from training automatically. A thumbs up/down can send the whole conversation to training even with training off. Help pages read via the Web Archive (the original blocks bots).	Until you delete them. Deleted: gone from your account at once, removed from servers within 30 days (unless kept longer for security or legal reasons). Temporary chats: deleted within 30 days.Temporary: Temporary Chat: not in your history, creates no memories, not used for training. It can still use your existing memory unless you turn personalization off when you start	Passkey: yes2FA: yes	2 Nov 2026sourcevendor source
ClaudeYou choose at sign-up	Settings → Privacy → Model Improvement toggleYou sign in only with Google or an email link/code: put a passkey or 2FA on that account. The passkey Claude Desktop sometimes asks for is for trusted devices, not for signing in.	Deleted: removed from servers within 30 days. With training on: up to 5 years. Flagged chats: up to 2 years.Temporary: Incognito: never used for training, even with Model Improvement on	Passkey: no2FA: no	2 Nov 2026sourcevendor source
GeminiTraining on by default	Web: Menu → Settings & help → Activity → Turn off. App: profile picture → Gemini Apps Activity → Turn off. The setting is called Keep ActivityPasskeys and 2-step verification live in your Google account.	18 months by default. With Keep Activity off: 72 hours. Chats reviewed by humans: up to 3 years.Temporary: Temporary chat: not used for training, deleted after 72 hours	Passkey: yes2FA: yes	2 Nov 2026sourcevendor source
GrokTraining on by default	App: Settings → Data Controls → turn off Improve the model. Web (grok.com): Settings → Data → Improve the Model. Grok inside X has a separate toggleTurn on 2FA (authenticator) and recovery codes at accounts.x.ai → Security. Feedback (thumbs) may be used for training even after opting out. FAQ read via the Web Archive (20 Oct 2026); only guides confirm training is on by default.	Deleted chats and Private Chats: removed from servers within 30 days unless de-identified or kept longer for safety or legal reasons.Temporary: Private Chat (ghost icon, top right): not in your history, not used for training	Passkey: ⚠ unknown2FA: yes	2 Nov 2026sourcevia press/search result
Mistral Vibe (Le Chat)Training on by default	Web: Admin panel → Manage → Vibe → Privacy → turn off Allow your interactions to be used to train our models. App: Settings → Account → Data & Account Controls → turn off Enable data sharing2FA with an authenticator app: Security & Access → Multi-factor authentication; then generate backup codes. Thumbs feedback with a comment may always be used for training.	Until you delete the chat or your account (privacy policy of 3 Sep 2026). No temporary chat.	Passkey: ⚠ unknown2FA: yes	2 Nov 2026sourcevendor source
Microsoft CopilotTraining off by default	New app (since 18 Aug 2026): no toggle needed, chats aren't used to train models. Old app: Privacy → turn off Training on conversation activity and Training on voice conversationsThe 2024 EEA exemption is no longer in Microsoft's FAQ: in the old app training is on in the Netherlands too. Update the app or turn the toggles off.	Until you delete the chat (one by one, or everything via the Microsoft privacy dashboard). Old app: 18 months.	Passkey: yes2FA: yes	2 Nov 2026sourcevendor source
Meta AITraining on by default	No toggle: object via the Facebook or Instagram Privacy Centre (object to the use of my information for Meta AI). Only covers future processingSince 27 May 2025 Meta trains on public posts and Meta AI conversations in the EU; no newer change found. The public Discover feed is gone. Passkeys and 2FA live in your Meta account (Accounts Centre).	No fixed period: Meta decides case by case. In WhatsApp, Delete chat only removes your copy; remove Meta's copy with /reset-ai (one chat) or /reset-all-ais (all).Temporary: Incognito Chat (WhatsApp and Meta AI app, rolling out since May 2026): not saved; not available everywhere yet	Passkey: yes2FA: yes	2 Nov 2026sourcevia press/search result
DeepSeekTraining on by default	No toggle found in the app; opt out by emailing the address in the privacy policyThe Dutch Data Protection Authority warned about the app in 2025. No temporary chat.	Stored on servers in China; kept as long as you have an account (sometimes longer). You can delete chat history yourself.	Passkey: ⚠ unknown2FA: ⚠ unknown	2 Nov 2026sourcevendor source

⚠ = not (fully) verified: check the app yourself. Menus change often; the date shows when we checked.

Privacy minimum in 5 minutes

1. Turn off training. Use the path from the table. Afterwards, check it in the app on your phone as well.

2. Clean up shared links. Look in the settings for Shared links and delete everything that no longer needs to be shared. In ChatGPT: Settings → Data controls → Shared links → Manage. A deleted link stops new access; copies others already saved remain.

3. Review your memory. Look for Memory or Personalization. Erase what’s wrong or too personal.

4. Disconnect apps you don’t use. Gmail, Drive, calendar: whatever you didn’t use in the past 30 days goes. Connected email is also a way in for attackers: in September 2025 a researcher showed how a malicious calendar invite made ChatGPT with a Gmail connection leak emails.

5. Lock down your account. Passkey or 2FA on. Do you log in with Google, Apple, Microsoft or an email link? Then secure that account: it’s the real key to your assistant.

Training off isn't private yet

Training, history and memory are three separate systems. The training switch only controls the first. So for a sensitive question, also open a temporary or incognito chat: at Claude, incognito is never used for training, not even when Model Improvement is on.

ChatGPT: security and training off in one go

With Advanced Account Security (since 30 April 2026) you can only log in with passkeys or a security key, sessions are shorter, and your chats are automatically excluded from training. The risk: if you lose your passkeys, OpenAI Support can’t help you. Recovery is then only possible with your own backup passkeys, security keys or the single-use recovery keys you get when you turn it on (after using one, your account unlocks 48 hours later). So set up at least two (phone plus password manager or hardware key) and keep your recovery keys offline.

One bare browser profile for AI

Extensions were the leak of 2026: in January, two Chrome extensions with around 900,000 users combined forwarded ChatGPT and DeepSeek chats to attackers. An extension that may “read all websites” also reads your chats. Create a separate browser profile without extensions for AI, banking and admin panels; it costs nothing.

Security

Chats in your history you don’t recognise, or a login notification that wasn’t you? Do this in the first 15 minutes:

• Log out everywhere. At Claude: on claude.ai in the browser, Settings → Account → Log Out (not in the mobile app; also logs out Claude Code); at other assistants it’s called something similar. Only changing your password isn’t enough: a stolen session can keep working.
• Secure the account you log in with. New password, passkey or 2FA on, and check your recovery email and phone number.
• Go through connected apps, shared links and memory and delete what you don’t recognise.
• Remove unknown browser extensions and scan your computer. More on what never belongs in a chat: what you never paste into a chat.

Checklist

0/6

• Training is off in my assistant (or I consciously chose to keep it on)
• I know where the temporary or incognito chat is
• Shared links cleaned up
• Memory reviewed and cleaned up
• Connected apps I don't use disconnected
• Passkey or 2FA on for my assistant or for the account I log in with

Your progress is only stored in this browser.

Test yourself

1. 1You turned off training. What can still happen to your chats?

   Nothing, they are erased immediatelyThey are still kept for a while and can be checked for abuseThey are still used to train the model

2. 2You log in to Claude with your Google account. Where do you turn on 2FA?

   In Claude itselfOn your Google accountNowhere, Google is secure enough already

3. 3Why do you only connect Gmail if you really use it?

   Because it costs extra moneyBecause an email or invite can contain hidden instructions that the assistant carries outBecause it makes the assistant slower

Next lesson: your first good prompt. Following the AI security basics learning path? Then continue with the dangerous combination: data, input and actions.