Does AI store your data? What really happens to your prompts
When you send a prompt to an AI, where does it go and who can read it? What really happens to your data — and how to keep control.
When you send a prompt to an AI like ChatGPT, Claude or Gemini, it leaves your machine, transits encrypted to the provider's servers, and may be retained for a while — for security, support or, depending on the plan and your settings, model improvement. In other words: everything you paste leaves your environment. The only way to keep control is to never put sensitive data in it in the clear.
A prompt's journey, step by step
- 1You write a prompt and send it: it leaves your browser or app.
- 2It transits, encrypted in transport, to the provider's infrastructure (often outside the EU).
- 3It is processed by the model, which generates an answer.
- 4Depending on the plan and settings, the content may be retained (logging, moderation, training).
“Encrypted” doesn't mean “private”
Encryption in transit protects your prompt against interception on the network, but not against the provider itself: once it arrives, the content is readable server-side to be processed. “Enterprise” modes and no-training settings reduce retention, but they don't change the fundamental fact: the data has left your perimeter.
- Retention and reuse depend on the plan, the country and your settings — so they change.
- Data that has left is data out of your control, even if a policy promises to delete it.
- The weak link is almost always copy-paste, not a technical flaw.
Take back control: send only anonymized text
Rather than betting on a third party's retention policy, the safest approach is to decide, client-side, what is allowed to leave. An anonymization engine detects sensitive data, replaces it with reversible tokens, and only lets the neutralized text out. The answer is restored in your browser — the provider never saw the original.
ONYRI Sanitize applies exactly this principle: detection and the token ↔ value mapping stay in your browser, and only the anonymized text reaches the model. You get AI's benefits without having to blindly trust what a server retains.
Frequently asked questions
- Does ChatGPT really save my conversations?
- By default, content may be retained for a while (security, support) and, depending on the plan and your settings, used to improve the service. Settings and “enterprise” plans limit this retention, but the prompt leaves your environment either way. That's why you don't put sensitive data in it in the clear.
- Are my prompts used to train the model?
- It depends on the provider, the plan and your settings — it varies and can change. Rather than tracking every policy, the robust rule is anonymization: if sensitive data never leaves, the training question no longer applies to it.
- Isn't encryption enough to protect me?
- Encryption in transit protects against network interception, not against the provider that must read the prompt to process it. For sensitive data, the effective protection is not to send it — so anonymize it first.
Sources & references
Keep your sensitive data in your browser
ONYRI Sanitize detects and masks your sensitive data before it reaches the AI, then restores the answer — from names to API keys.
Anonymize my prompt