How to Stay Safe and Secure Using ChatGPT

When prompted, this is how ChatGPT sees itself.

A practical guide to protecting your account, your data, and your privacy when using OpenAI's ChatGPT.

1. Lock down your account

• Use a unique, strong password, or sign in with a passkey if your account supports one (Settings → Security → Passkeys). Passkeys let you sign in without a password using Face ID, Touch ID, or a security key (OpenAI Help Center, "Passkeys to secure your OpenAI account").

• Turn on multi-factor authentication (MFA). Go to Settings → Security → Multi-factor authentication. Options can include an authenticator app, push notifications, or SMS/WhatsApp codes — available methods vary by device, country, and account type (OpenAI Help Center, "Enabling or disabling multi-factor authentication (MFA)").

• Consider Advanced Account Security if you're a higher-risk user (journalist, public figure, dissident, researcher). This opt-in mode disables the weaker methods — email and SMS codes — and requires phishing-resistant options like passkeys or a physical security key, plus a recovery key you must save yourself.

• If someone else may already have access, reset your password first, then enable MFA — enabling MFA alone doesn't log out existing sessions.

2. Control what your data is used for

• "Improve the model for everyone" is the master training toggle. Found in Settings → Data Controls. When it's on, your chats and saved memories may be used to help train future models. Turn it off and new conversations stop being used for training (OpenAI, "How ChatGPT learns about the world while protecting privacy").

• Turning training off doesn't delete your history — conversations still appear in your chat history, they just aren't used for training.

• Temporary Chat goes further: it doesn't appear in history, doesn't create memories, and isn't used for training at all. Good for one-off sensitive questions. OpenAI states these are still retained for up to 30 days for safety purposes before deletion.

• Business, Enterprise, and Edu accounts are not trained on by default, regardless of the consumer toggle.

3. Manage Memory carefully

ChatGPT can remember facts about you across chats to personalize responses.

• Review and delete what it remembers: Settings → Personalization → Manage memories.

• Turn off "Reference saved memories" to stop ChatGPT from using stored facts about you (this also disables referencing your past chat history).

• Even after you delete a memory, OpenAI notes deleted content may briefly persist in backend logs for safety/debugging purposes before full removal.

• If you connect Google or other third-party apps, review what's synced — connected-app content follows separate rules from typed chat content (see OpenAI's data-controls FAQ for whichever integration you use).

4. Clean up your history and links

• Delete individual chats or bulk-delete from Data Controls.

• Archive chats you want out of your main list without deleting them.

• Shared links: if you've ever generated a public/view-only link to a conversation, go to Data Controls → Shared links to review and revoke ones you no longer want active.

5. Know what not to share

Regardless of your settings, some things shouldn't go into any AI chat:

• Passwords, API keys, or authentication tokens

• Full financial account numbers or national ID numbers

• Confidential employer or client data you're not authorized to share externally

• Sensitive medical or legal details tied to identifiable people

If your employer provides ChatGPT (Business/Enterprise), check their policy — even with strong personal privacy settings, workspace admins can typically see more than you'd expect on managed accounts.

6. Treat output as a draft, not a verdict

ChatGPT can be wrong, especially on niche facts, citations, math, or fast-changing information. Verify anything important — medical, legal, financial — before acting on it. Be cautious about following instructions to install software or run code without understanding what it does first.

7. Watch for prompt injection if you use browsing, connectors, or agents

If you use ChatGPT Atlas, browsing, or connected apps (Google Drive, Gmail, etc.), malicious content on a webpage or in a document can attempt to hijack an AI agent's instructions. Review what actions an agent is about to take — especially anything that sends messages, buys something, or modifies files — before approving it.

Quick checklist

• [ ] Passkey or strong password + MFA enabled

• [ ] Confirm "Improve the model for everyone" matches your preference

• [ ] Review and prune saved Memories

• [ ] Use Temporary Chat for one-off sensitive topics

• [ ] Revoke old shared links you don't need public

• [ ] Never paste secrets, credentials, or sensitive personal data

• [ ] Verify important factual output independently

Sources

• OpenAI Help Center — "Enabling or disabling multi-factor authentication (MFA)" (help.openai.com)

• OpenAI Help Center — "Passkeys to secure your OpenAI account" (help.openai.com)

• OpenAI Help Center — "How can I keep my OpenAI accounts secure?" (help.openai.com)

• OpenAI — "How ChatGPT learns about the world while protecting privacy" (openai.com)

• OpenAI Help Center — "Memory FAQ" (help.openai.com)

• OpenAI Help Center — "ChatGPT Atlas – Data Controls and Privacy" (help.openai.com)

• OpenAI Help Center — "Google App for ChatGPT – Data Controls FAQ" (help.openai.com)

This guide reflects publicly available OpenAI documentation as of July 2026. Settings and policies change — always check your account's Settings and OpenAI's Help Center for the current state.