Consumer AI chatbots are relatively new, so the privacy expectations around them are still being negotiated in real time, in courtrooms as much as in privacy policies. That's worth understanding before you paste a contract, a medical question, or a draft of something sensitive into a chat box.
Retention is the default, not the exception
For most consumer-tier chatbot products, conversation history is retained by default and used to improve the underlying model unless a user actively finds and enables an opt-out, such as a "temporary chat" or "don't train on my data" toggle. That opt-out typically has to be set per session or per account, and it's frequently reset by product updates, account changes, or a new device. The default is retention; privacy is the setting you have to go find.
Enterprise and API tiers are usually different. Business agreements from most major providers commit to not training on customer data by default, precisely because enterprise customers negotiate for it. The gap between the consumer product and the enterprise product is itself informative: the privacy protection exists, it's just priced and gated for the customers with leverage to ask for it.
Human review is part of the pipeline
Training data doesn't only mean an automated process. Providers commonly use human contractors to review sampled conversations for quality, safety, and abuse detection. That's a legitimate part of building a system that doesn't produce harmful output, but it means a real person can plausibly read a chat you assumed was private, especially content flagged by automated filters for containing something sensitive.
Preservation can override deletion
The clearest recent demonstration of how retention policy can be overtaken by outside events came from litigation, not from a privacy policy. In the New York Times' copyright lawsuit against OpenAI, a federal court ordered the company in 2025 to preserve ChatGPT output logs, including conversations that users had deleted or that were set to auto-delete, so they could be reviewed for potential evidence in the case. Deletion settings a user had actively chosen were overridden by a litigation hold they had no part in and no notice of.
A deletion button controls what happens under normal operation. It does not control what happens when the company becomes a party to litigation, receives a subpoena, or is compelled by a court order to preserve records it would otherwise be discarding. This is true of most cloud services, not unique to AI chatbots, but the scale and sensitivity of what people type into a chatbot makes it a sharper edge case.
Agentic assistants raise the stakes further
The privacy calculus changes again once a chatbot stops being a text box and starts being an agent with tool access: reading your calendar, drafting and sending email, browsing the web on your behalf, or connecting to your files. Each connected data source is a new category of information flowing into the same retention and review pipeline described above, and it's often granted through a single broad permission prompt rather than a conversation-by-conversation choice. A user who's careful about what they type into a chat window can still end up exposing a full calendar history or an inbox search to the same retention policy, because the permission was granted once, at setup, and rarely revisited.
Voice and image inputs add another layer. A voice conversation captures tone and background audio a typed message never would; an uploaded document or photo can contain far more embedded information (metadata, other people's data visible in a screenshot, a full page of a document beyond what was actually relevant to the question) than the user consciously intended to share. The retention and training questions above apply to all of it, not just the text you typed.
What actually differs between providers
| Question to ask | Why it matters |
|---|---|
| Is training-data use opt-in or opt-out? | Opt-out means your conversations are used unless you find the setting. Opt-in means nothing happens until you choose it. |
| What's the stated retention window? | Some providers delete raw conversation data after a fixed period even without user action; others retain indefinitely absent a manual deletion request. |
| Does a "delete" actually delete, or de-list? | Some products remove a conversation from your visible history immediately but retain the underlying data for a longer backend window before permanent deletion. |
| Is there a business or education tier with a no-training commitment? | If a provider offers a paid tier that promises not to train on your data, that's an admission the free tier doesn't make the same promise. |
Practical guidance
- Treat chat input like email to a company you don't control, not like a private notebook. The same threat-modeling discipline you'd apply to any sensitive communication applies here.
- Don't paste anything you wouldn't want in a legal-discovery request. Litigation holds, once triggered, can reach further back than a normal retention policy would.
- Use the privacy controls that exist, and check them periodically. Temporary-chat modes, training opt-outs, and auto-delete windows are real protections when enabled, and they're commonly reset by app updates or new device logins.
- Apply the same minimization instinct here as anywhere else. The data minimization principle, don't generate sensitive data you don't need to, is as relevant to a chatbot conversation as it is to any form you fill out online.
- Review connected-app permissions on a schedule, not just at setup. A calendar, email, or file connection granted once during onboarding is easy to forget about; revisiting what's actually connected every few months catches scope creep before it accumulates.
None of this argues against using these tools. It argues for reading the specific policy of the specific product you're using, rather than assuming "AI chatbot" is a single category with a single privacy posture. The gap between a consumer default and a business-tier no-training commitment, or between a text-only assistant and an agentic one with calendar and email access, is often the whole difference between a private tool and one that quietly becomes a second copy of your inbox.
Where Haven fits
Haven doesn't build an AI chatbot, and the point of this post isn't to sell you on one that does. It's that the question worth asking of any service handling sensitive text, chatbot or otherwise, isn't what the marketing promises. It's what the retention and legal-preservation chain actually allows that data to become once it leaves your screen.