Let us begin by naming what we are trying to protect.

Sensitive information is anything that could cause harm, embarrassment, financial loss or legal trouble if it reached the wrong people. The harm can fall on you, on people you know, or on an organisation you work for. Some of it is obviously private. Some of it only seems harmless until it is combined with other details.

Understanding the journey of a message makes the protections easier to understand.

When you send a message or upload a file, it travels to Anthropic’s systems, where Claude reads it and writes a reply. On consumer plans, your conversations are saved to your account until you delete them, according to Anthropic’s materials. Depending on your settings and plan, conversation data may also be used to improve Claude, kept for a period, reviewed in limited circumstances such as safety checks, or fed into features such as memory. Different account types follow different rules.

flowchart TD
  A["You type, upload or connect something"] --> B["Sent to Anthropic's systems"]
  B --> C["Claude reads it and replies"]
  B --> D["Saved in your chat history until you delete it"]
  D --> E{"Which settings and plan apply?"}
  E -- "Training setting on, consumer plan" --> F["May be used to improve models, with longer retention"]
  E -- "Training setting off" --> G["Not used for future training"]
  E -- "Incognito chat" --> H["Not saved to history or memory"]
        

For consumer accounts, one setting matters more than any other.

On Claude’s consumer plans, Free, Pro and Max, Anthropic describes a setting called Help improve Claude in the Privacy section of your Settings. When it is on, you allow Anthropic to use your chats and coding sessions to improve its models and safeguards. Anthropic’s privacy materials say that if you allow this, data may be retained in a de-identified form for up to five years in model training pipelines, and that the longer period applies to new or resumed chats after the setting is enabled.

When the setting is off, Anthropic says it will not use your chats and coding sessions for future model training. Anthropic’s privacy pages also say that deleting a chat from your history means it will not be used to train future models. Coverage points out that changing the setting affects future use, and that data already included in a completed training cycle cannot be removed retroactively.

You are not stuck with everything you have ever typed.

You can delete individual conversations from your history, delete several at once and, if you wish, delete your account. Anthropic’s privacy pages explain how deleted data is handled, and note that the retention period depends on whether you allowed your data to be used to improve Claude. Coverage in 2025 and 2026 describes a standard shorter retention period for people who opted out, and a much longer one for those who opted in, but articles disagree on current wording. For exact figures, read the current retention article at privacy.claude.com.

Sometimes you want a private conversation that leaves no trace in your history.

An incognito chat is a temporary conversation. According to Claude’s help centre, it is not saved to your chat history and does not contribute to memory, and Claude does not pull information from incognito chats when searching previous conversations. Coverage of Anthropic’s privacy information says incognito conversations are not used to improve Claude, even when the training setting is on. Incognito chats are available on all plans, and you start one with the ghost icon.

However, incognito does not mean invisible to everyone. The help centre notes that on organisational plans, incognito chats can still be included in organisational data exports and follow the organisation’s retention policies, and Anthropic’s materials describe a limited retention period for incognito chats. So incognito means “not in my history or memory”, not “nobody could ever access it”.

flowchart TD
  A["Start a conversation"] --> B{"Incognito?"}
  B -- "No" --> C["Saved to history and may feed memory"]
  B -- "Yes" --> D["Not in history, not added to memory"]
  D --> E["Organisation rules and limited retention may still apply"]
        

If memory is on, Claude may carry details from one chat to another, so it deserves its own controls.

Claude’s memory saves useful context, such as preferences and ongoing work, so you do not have to repeat yourself. Anthropic’s help pages say that you can view what is stored, edit or delete items, and turn memory off. Release notes from August 2026 describe topics such as health or beliefs staying out of memory by default unless you turn on a setting called Include sensitive topics in memory, found in the memory settings. Coverage adds that when that setting is on, Claude shows a notice each time it saves a sensitive topic, that it applies going forward, and that certain information, such as government ID numbers, criminal history or immigration status, is not stored even then.

Coverage also notes that memory is retained in line with your normal chat retention policies and that there is no separate retention control for memory. For a clean slate on a particular conversation, use an incognito chat. And because the memory feature has changed several times, check the current article on how memory works.

Documents often contain more than you realise.

When you upload a file or paste a long text, everything in it is part of the conversation, not just the part you care about. A spreadsheet may hold hidden columns. A screenshot may show open tabs, notifications or names in the corner. A contract may include signatures and account numbers. A copied email thread may include other people’s addresses. Claude’s reply may be based on all of it.

Connecting Claude to your accounts is powerful, and it widens what Claude can see.

A connector is a link that lets Claude use another service, such as email, calendar, documents or chat, with your permission. Once connected, Claude can search or read content in that service when it helps with your request. This is convenient, but it also means that anything inside the connected service could end up in a conversation, including private messages and shared documents. Security commentary describes connectors as one of the main places where sensitive data flows into AI tools.

Sometimes the danger is not what you share, but what Claude reads.

Prompt injection is an attack in which text hidden inside a document, web page, email or message tries to give Claude instructions that you never wrote. For example, a web page might contain invisible text telling the AI to reveal your conversation or to take some action. Anthropic has said publicly that prompt injection remains an important security problem for AI systems, and it appears in Anthropic’s own safety materials.

Researchers have also reported specific weaknesses over time. One 2026 report described an attack chain that combined hidden instructions in a pre-filled Claude link with other flaws, and said the prompt-injection part had been fixed while other issues were still being addressed at the time of publication. The general lesson is that you should be cautious about links, shared prompts and documents from sources you do not trust, and that connectors and tools make injection more serious, because Claude may have the access to act on hidden instructions.

flowchart TD
  A["Untrusted document, web page or link"] --> B["Contains hidden instructions"]
  B --> C["Claude reads it while helping you"]
  C --> D{"Does Claude have access to your data or tools?"}
  D -- "Little access" --> E["Limited harm possible"]
  D -- "Broad access" --> F["Greater risk of data exposure or unwanted actions"]
        

A short routine before each sensitive task builds good habits quickly.

Some things simply do not belong in a conversation with any AI tool.

Using Claude for work adds rules on top of your own preferences.

Anthropic’s materials describe different terms for consumer and commercial products. Team, Enterprise and API customers are covered by commercial terms, with organisation-level controls, and coverage notes that enterprise deployments can have configurable retention and, for qualifying use, zero data retention options. Administrators may control which features, connectors and memory settings are available, and organisational data exports can include incognito chats. On Team and Enterprise plans, memory is described as off by default until an owner turns it on.

For you as an individual, the key point is that your employer’s rules come first. If you handle client data, health records, financial information or trade secrets, check your organisation’s policy on AI tools before you share anything, and use the account your employer provides rather than a personal one for work material.

Protecting what is inside Claude also means protecting the way in.

Your conversation history and memory are tied to your account. If someone else gets into your account, they may be able to read what you have shared. So ordinary account hygiene matters. Use a strong, unique password, protect the email address linked to your account, be wary of phishing messages that imitate Claude or Anthropic, and use any additional sign-in protections that your sign-in method offers.

If you use Claude with code or through the API, a few extra protections apply.

Code often contains secrets: passwords, API keys and tokens. When Claude reads a project, for example through a coding tool, those secrets can end up in the conversation or in logs. Security guides for coding tools recommend keeping secrets out of project files, blocking the tool from reading files that contain them, keeping permissions tight and reviewing what the tool does. They also note that session histories can be stored on your own machine, so cleaning up sessions that touched sensitive material is wise.

These errors appear often, and each has an easy fix.

On consumer plans, Anthropic says it uses chats and coding sessions for training only if you allow it through the Help improve Claude setting. Check the setting in Privacy. Commercial plans follow different terms. Details can change, so check the current privacy pages.

Open Settings, go to Privacy and switch off Help improve Claude. This affects future use. Anthropic says deleting a chat also keeps it from being used for future training.

It depends on your plan and settings. Anthropic’s privacy pages say that if you allow use for improving Claude, data may be retained in de-identified form for up to five years. Check the current retention article for exact figures, since descriptions have changed.

A temporary chat started with the ghost icon. It is not saved to your history or memory and, per Anthropic’s information, is not used to improve Claude. Organisational plans may still apply export and retention rules.

Yes. Open the Memory settings to view stored items, edit or delete them, and turn memory off. A separate setting controls whether sensitive topics can be saved.

An attack where hidden text in a document, web page or message tries to give Claude instructions you did not write. Be cautious with untrusted content and links, and limit connected access.

It can be useful, but it widens what Claude can reach. Connect only what you need, review permissions, disconnect unused connections and follow workplace controls.

Passwords, one-time codes, payment card details, government ID numbers, API keys and tokens, confidential material you are not allowed to share and other people’s private details.

Change or revoke it immediately, then delete the conversation and check your memory. Deleting the chat alone does not make an exposed credential safe.

The privacy centre at privacy.claude.com, the help articles at support.claude.com, and the Privacy and Memory sections of your own Settings. These change over time, so check dates.

Protecting sensitive information in Claude starts with knowing what counts as sensitive and sharing only what a task truly needs. On consumer plans, the Help improve Claude setting decides whether your future chats can be used for model training and affects how long data may be retained, so it is worth checking. You can delete chats, use incognito chats for one-off private questions, and view, edit and limit memory, including the setting for sensitive topics. Files, screenshots and connectors can carry more than you intend, so trim, crop, replace identifiers and connect only what you need. Hidden instructions in untrusted content, known as prompt injection, are a real risk that limited access and careful habits reduce. Never paste passwords, codes, payment details, identity numbers or keys, and if you do, revoke them at once. Work accounts add organisational rules that come first, and strong account security protects everything inside. Because settings and terms change, check the current privacy and help pages regularly.