Is it safe to give ChatGPT or Claude your notes?

Connecting ChatGPT to your notes takes about a minute. Deciding what happens to them afterward takes five more, and most people skip it.

They matter. On a personal ChatGPT plan, what it reads from your notes can be used to train OpenAI’s models until you switch that off. Claude can turn a note it read into a memory that outlives the chat. And Gemini won’t read your Google Docs or Keep notes at all unless you let Google train on your chats.

None of that is a reason not to connect. It’s a reason to spend five minutes in settings first. Here’s what to check, company by company, read from their own help pages on November 5, 2026.

A word about us first. We make Harbor, a notes app you can connect to ChatGPT and Claude. It comes up near the end, with what it does well and where it falls short.

The short version

• Turn off training. It’s on by default in ChatGPT’s personal plans and in Gemini. Claude made everyone choose in 2025, so check what you picked.
• Decide about memory. ChatGPT and Claude can both remember things they read in your notes, and deleting the chat doesn’t delete the memory.
• Let it read freely. Approve every edit.
• Keep your most sensitive notes out of reach. Settings change what the AI company keeps. They don’t change what it receives.
• Our view: ChatGPT and Claude can both be set up sensibly. Gemini on a personal Google account can’t, at least not for Docs and Keep.

Where your notes go

You ask, “What did I decide about the roof?” The AI asks your notes app for notes that match. Your notes app sends back the text, and from then on that text is part of your conversation, stored on the AI company’s servers under the AI company’s rules.

So two privacy policies cover the same note. Your notes app’s covers the copy in your library. The AI company’s covers the copy in the chat. Your notes app never sees the chat and can’t delete it for you.

That’s why the settings that matter are on the AI side.

Does it train on your notes?

ChatGPT. OpenAI says it plainly: on Free, Plus, Go and Pro, it “may use information accessed from apps to train our models” if Improve the model for everyone is on. It’s on by default. Turning it off keeps your chat history, so there’s nothing to trade away. One exception runs in your favor: OpenAI doesn’t train its general models on what ChatGPT pulls directly from connected Google apps, even with the setting on. What ends up in ChatGPT’s reply is another matter.

Claude. Anthropic asked every Claude user to choose by October 8, 2025. Say yes, and new chats can be kept for training, de-identified, for up to five years. Say no, and it’s 30 days. If you don’t remember choosing, look under Settings › Privacy. Anthropic’s help page calls the switch “Help Improve our AI models,” and older guides call it “Help improve Claude.”

Anthropic also does something we’d like to see everywhere. It leaves the raw content Claude pulls through a connector, MCP servers included, out of its training data. The catch is in the same sentence: data “may be included if it’s directly copied into your conversation.” Claude’s answers quote and summarize your notes, and those answers are the conversation. So the switch still matters.

Gemini. This is the hard one. On a personal Google account, Keep Activity is on by default for adults, and Google uses that activity to train its models “with the help of human reviewers.” Turn Keep Activity off and Workspace apps like Docs, Drive and Keep stop being available to Gemini. If you want Gemini reading your Keep notes, you’re agreeing to training.

Google says it doesn’t train “directly” on your Drive or Keep. It trains on the summaries, excerpts and inferences Gemini makes from them. And “where the email or file is brief,” the summary “may just be the email or file.” Most notes are brief.

One catch everywhere: the thumbs. Rate a ChatGPT reply up or down, and OpenAI says “the entire conversation associated with that feedback may be used to train” its models, even if you’ve opted out. Anthropic keeps rated chats for up to five years. If a chat has your notes in it, skip the thumbs.

How long they keep it

• ChatGPT keeps chats until you delete them, then removes them within 30 days. A Temporary Chat is kept up to 30 days and isn’t used for training.
• Claude keeps chats 30 days with training off, and up to five years, de-identified, with it on. A deleted chat leaves Anthropic’s servers within 30 days. Incognito chats are kept 30 days and aren’t used for training.
• Gemini deletes your activity after 18 months, unless you pick 3 or 36 or turn auto-delete off. With Keep Activity off, it still holds new chats for 72 hours.

A chat that gets a closer look is kept longer. If Anthropic’s safety systems flag one, it keeps it up to two years. Google keeps chats its human reviewers read for up to three years, and deleting your activity doesn’t remove them. OpenAI says authorized staff and contractors can read conversations to investigate abuse, give support, handle legal matters and, unless you’ve opted out, improve its models.

That’s ordinary for a chat service. It’s also why the most sensitive notes belong further down this page.

Memory remembers what it read

Both assistants can carry something from your notes into later chats.

ChatGPT “may remember relevant information accessed from the app,” and deleting the chat doesn’t delete a memory it saved. The controls are in Settings › Personalization › Memory.

Claude’s memory is on by default on Free, Pro, Max and Ultra. Anthropic’s words: “When a conversation is deleted… memory entries generated from it aren’t removed.” You delete those one at a time. The switch is in Settings › Your Claude, under Generate memory from chats.

Memory is useful. It’s also how a detail from a private note turns up in an unrelated chat weeks later. If you connect your notes, either turn memory off or read what it saved after the first week.

Four settings to check before you connect

1. Training. ChatGPT: Settings › Data controls › Improve the model for everyone, off. Claude: Settings › Privacy, off. Gemini: there’s no way to keep Docs and Keep connected with it off.
2. Memory. ChatGPT: Settings › Personalization › Memory. Claude: Settings › Your Claude. Off, or check it often.
3. Approvals. In ChatGPT, open Settings › Plugins › Permissions. Unless you change it, ChatGPT uses Allow low-risk actions, which means it decides what’s low-risk and does it without asking. Pick Allow read actions instead: it reads without asking and asks before it changes anything. In Claude, open Customize › Connectors and set each tool to Always allow, Needs approval or Blocked. Reading tools on Always allow, anything that writes on Needs approval. Anthropic’s advice is to “only click ‘Allow always’ when using a server and tool that you trust to run unsupervised.”
4. A private mode for one-offs. For a single sensitive question, use Temporary Chat in ChatGPT or an incognito chat in Claude. Neither is used for training, and both are kept 30 days. ChatGPT’s temporary chats can still use your plugins if you let them.

The steps for connecting are in how to connect ChatGPT to your notes and how to build a second brain with Claude.

Keep some notes out entirely

Settings decide what the AI company keeps. They don’t change what it receives. Once a note is in a chat, it’s on their servers for at least a while.

For the few notes that should never get there, the only sure fix is a connector that can’t read them.

• Encrypt them, if your notes app encrypts end to end. A connector that runs on the notes company’s servers only has ciphertext to send. Encryption costs you search and OCR on those notes, which we went through in should you encrypt your notes?
• Keep them somewhere you haven’t connected. A second app, or a second account.
• Don’t paste them. Pasting is the other way in, and the exceptions above don’t apply to it. OpenAI’s Google exception and Anthropic’s connector exclusion cover what the assistant fetches, not what you paste.

Notes can carry instructions

One more thing, and OpenAI and Anthropic both warn about it. A note can contain text the AI reads as an instruction. A web page you clipped years ago could include a line telling the assistant to do something you never asked for. If the assistant reads that note while it’s allowed to edit or send things, it might try.

That’s called prompt injection. OpenAI says its protections “do not eliminate third-party or prompt-injection risk.” Anthropic says to “pay attention to tool inputs & outputs and connect only to trusted servers.”

The fix is setting 3. An assistant that has to ask before it changes anything can’t be quietly talked into it. And connect your notes company’s own server, not a third party’s. We covered the rest of that checklist in MCP servers for notes, explained.

Where Harbor fits

We make Harbor, so read this part knowing that.

Harbor has no AI of its own, so nothing you write trains anything through us. You bring ChatGPT or Claude. Here’s what that connection does:

• You approve it on Harbor’s own screen. It lists what the assistant can do and says, before you click, that encrypted notes stay encrypted.
• Encrypted notes stay unreadable. They reach ChatGPT and Claude as ciphertext, because that’s all our servers hold. You can set a notebook to encrypt everything in it, so “the private notebook” is something you can actually have.
• It can’t delete. Harbor’s connector can search, read, create, edit, move and tag. It has no tool to delete or trash a note.
• Edits can be undone. Every change lands in the note’s version history, and restoring is one click.
• Reading and writing are labeled. Harbor marks its reading tools as read-only, so Allow read actions in ChatGPT and per-tool settings in Claude do what they say.
• One click cuts it off. Settings › Developer › Connected apps › Disconnect, and the assistant loses access immediately.

Where it’s behind. Three places.

• There’s no read-only connection. Harbor’s Notes permission covers reading and writing, and you can’t limit a connection to one notebook. Keeping the assistant from editing is up to the approval settings above.
• Harbor can’t reach into the chat. Once ChatGPT or Claude has read a note, their rules apply, the same as with any notes app.
• The command-line tool is the exception to the encryption rule. It runs on your own computer, so with your passphrase set there, an AI agent working in that terminal can read encrypted notes. The connection help page covers it.

The settings take five minutes. Do them before the first question, not after.

Sources

OpenAI: Data controls · Connected apps in ChatGPT · Google app data controls · Managing app permissions · Custom MCP servers · Chat and file retention · Temporary Chat · Memory · How OpenAI handles data in consumer services · Privacy policy.

Anthropic: Changing your model-improvement setting · Is my data used for model training? · How long do you store my data? · Updates to the consumer terms (August 28, 2025) · Remote MCP servers and safety · Connector tool permissions · Memory · Incognito chats · Commercial products and training · Privacy policy.

Google: Gemini Apps Privacy Hub · Keep Activity · Connected Apps and your data · Connected Apps when Keep Activity is off · Gemini in Workspace.

Last checked: November 5, 2026. We read each company’s own help pages and policies for this post. These pages change often, and a few of them changed in the week we wrote it. If something here no longer matches what you see, tell us at hello@harbor.my and we’ll fix it and re-date this line.