"Is it safe" is the wrong question, because it has no single answer. What matters is what happens to a specific file under a specific contract — and those differ enormously between a free consumer account and an enterprise agreement, in ways the interface does not make obvious. This page sets out what actually happens and how to decide per document.
The short version
The tier determines the answer. Consumer plans have historically used content for training by default. Business, enterprise and API tiers generally do not, by contract. Before uploading anything sensitive, find out which you are on — the product name does not tell you.
What happens to an uploaded file
Steps 4 through 7 are where the real questions live, and they are contractual rather than technical. The same model, the same interface and the same upload button can sit behind entirely different data commitments.
| Tier | Training on your content | Typical retention |
|---|---|---|
| Consumer free | Often yes, by default | Indefinite while account active |
| Consumer paid | Often yes, with an opt-out | Indefinite while account active |
| Business / Team | Generally no | Admin-configurable |
| Enterprise | No, contractually | Negotiated |
| API | Generally no | ~30 days for abuse monitoring |
| Local model | No transmission at all | Your disk |
These are general patterns and every provider's specific terms differ and change. The durable point is that the tier is the variable that matters, and most people do not know which one their organisation is on.
⚠️ "We don't train on your data" is narrower than it sounds
It is a statement about model training. It is not a statement about retention, about human review for safety, about subprocessor access, about backup lifetime, or about what happens under legal process.
Most providers retain content for a period regardless of training policy, precisely so abuse can be investigated. That is reasonable and it means "not used for training" and "not stored" are different claims. Read for both.
What you send without realising
This is the part almost nobody accounts for. Uploading a document sends the file, not the page — and files carry considerably more than what is displayed.
| Format | Also contains |
|---|---|
| DOCX | Author, last editor, revision count, total editing time, tracked changes, comments, and every image at full resolution behind any crop |
| Producing software, and with incremental updates, earlier versions of edited text | |
| XLSX | Hidden sheets, hidden columns, formulas revealing source systems, cached external data |
| Images | GPS coordinates, timestamps, camera serial, and thumbnails that may predate a crop |
| PPTX | Speaker notes, deleted slides in some cases, full-resolution images |
🚨 The redaction failure
A black rectangle over PDF text is a drawing instruction placed above the text. The text is still in the file and text extraction returns it — which is exactly what an AI tool does on upload.
The same applies to a Word crop, which stores the whole original image, and to a black shape drawn over a paragraph. Every one of these looks redacted on screen and uploads intact.
Verify before uploading: pdftotext document.pdf - and search the output for what should be gone.
A rule that works
Rather than a blanket policy, sort by what the document would cost you if it leaked:
| Content | Consumer tier | Business / API | Local only |
|---|---|---|---|
| Public or published material | Fine | Fine | Fine |
| Internal notes, drafts | Probably fine | Fine | Fine |
| Customer data, PII | No | Check your DPA | Preferred |
| Health or financial records | No | Only under a signed agreement | Preferred |
| Legally privileged material | No | Take legal advice | Preferred |
| Credentials, keys, tokens | Never | Never | Never |
| Third-party confidential material | No | Check the NDA | Check the NDA |
Two rows deserve expanding.
Credentials, never. Not because the provider is untrustworthy, but because a secret that has been transmitted and stored anywhere outside your control should be treated as compromised and rotated. This is standard practice for pasting a key into any third-party system, and AI tools are not an exception.
Third-party confidential material is the one people miss. Your NDA with a client may prohibit disclosing their material to subprocessors you have not disclosed. Uploading their document to an AI tool can breach that obligation even where the provider's own terms are impeccable — the issue is your contract with the client, not the provider's with you.
Reducing exposure without stopping
Most of the value is available without sending the sensitive part.
| Instead of | Try |
|---|---|
| Uploading the customer list | Upload the schema and two invented rows |
| Pasting the whole contract | Paste the clause, with names replaced |
| Uploading the incident log | Redact identifiers, keep the structure |
| Sending the spreadsheet | Send column names and ask for the formula |
| Uploading the codebase | Send the function, not the repository |
The general move: send the shape of the problem, not the data. A model asked to write a query needs the schema, not the rows. Asked to review a clause, it needs the clause, not the parties. This is usually a better prompt as well as a safer one — less irrelevant context, sharper answer.
The local option
Running a model on your own hardware removes the question entirely. Nothing is transmitted, so there is no retention policy, no subprocessor, no terms of service and no jurisdiction question.
| Cloud | Local | |
|---|---|---|
| Capability | Frontier | Meaningfully weaker |
| Data leaves your machine | Yes | No |
| Cost model | Per token | Hardware, then free |
| Setup | None | Real |
| Works offline | No | Yes |
| Compliance story | Depends on contracts | Simple |
The realistic pattern for most organisations is tiered: a capable cloud model for ordinary work, a local model for anything that must not leave the building. That is a better answer than either extreme, and it means the sensitive path does not depend on anyone remembering a policy.
✅ The same logic applies to file tools
The question is not unique to AI. Every online converter, compressor and PDF tool involves uploading a file to someone else's server, with the same retention and access questions and usually far less scrutiny of the terms.
Tools that process files in the browser avoid this entirely — the file never leaves the device, so there is nothing to retain, nothing to breach and no policy to read. For a contract, a medical record or an internal document, that is a materially different proposition from an upload.
Questions worth answering before you decide
- Which tier are we actually on? Most people guess wrong.
- Is training excluded, and where is that written? A marketing page is not a contract.
- What is the retention period, including after deletion?
- Who can access it internally, and under what circumstances?
- Where is it processed and stored? Jurisdiction may matter to your obligations.
- Is there a signed agreement — DPA, BAA — where regulation requires one?
- What do our contracts with clients say about subprocessors?
- Does the document carry metadata beyond what is visible?
Clean a document before it goes anywhere
Strip metadata, split PDFs and convert files entirely in your browser — nothing is uploaded, so there is no retention question to ask.
Open the EXIF Remover →Summary
- The tier determines the answer, not the product.
- "We don't train on your data" is not "we don't store it."
- Files carry metadata — authors, revisions, cropped originals, earlier PDF versions.
- Black boxes and Word crops hide nothing from a text extractor.
- Never send credentials. Transmitted means rotate.
- Third-party confidential material may breach your NDA, regardless of provider terms.
- Send the shape, not the data — schemas and clauses, not rows and names.
- Local processing removes the question rather than answering it.
Frequently Asked Questions
Do AI companies train on documents I upload?
It depends entirely on the tier. Consumer free and paid plans have historically used conversations for training by default, usually with an opt-out. Business, enterprise and API tiers generally do not train on customer content by contract. The distinction is the plan you are on, not the product name.
How long is my uploaded file kept?
Typically 30 days for abuse monitoring even where training is excluded, and sometimes longer under legal hold. Deleting a conversation removes it from your view; it does not necessarily purge it from backups or moderation systems immediately.
What is the difference between the app and the API for privacy?
API access is normally covered by terms excluding training on your inputs, with shorter retention. Consumer apps have historically been the opposite by default. If you are handling anything sensitive, the API or a business tier is a materially different legal position from a personal account.
What metadata do I send when I upload a document?
Whatever the file carries — author names, revision history, tracked changes, comments, embedded original images behind crops, and in PDFs often earlier versions of edited text. Uploading a document sends considerably more than what is visible on the page.
Is running a model locally actually more private?
Yes, in the meaningful sense that no data leaves the machine. There is no transmission, no third-party retention and no terms of service. The trade-offs are capability and cost — a local model is generally weaker than a frontier one, and you supply the hardware.