If you found someone’s diary, what would you do with it? That was the question that sat in my mind as I stared at my laptop screen, slightly shocked, after uploading my ChatGPT export to Proton AI Paper Trail.
The free tool built by privacy software engineers at Proton has one job: to analyse your exported chat history from ChatGPT or Claude and show you exactly how much of yourself you have inadvertently handed over. It runs on Lumo — the company’s privacy-focused LLM — which, unlike the data-harvesting mindset of Big Tech giants, claims to delete user data immediately without retaining any of it.
I braced myself for the picture I knew I had volunteered — a hypochondriac fretting over career moves, various financial details, and a person prone to brainstorming relationship issues and researching travel plans. However, the profile I received was far more detailed than I had expected. It nailed some traits of my character to a degree even my relatives probably wouldn’t guess.
The Proton AI Paper Trail report has sorted me into categories. A ‘Financial Background’ section detailed quite sensitive information I never explicitly mentioned. A ‘Health Limitations’ category tracked my health changes over months, including injuries and facilities I have turned to for help.
To some relief, a ‘Family’ section was fabricated, reiterating that LLMs can still hallucinate. Nevertheless, the attempt was real, and would only sharpen with more data and time.
Concerningly, the report rated me ‘easy’ to profile. It even assigned me an ‘ad value’: a four-figure dollar amount, with a list of sectors that would bid for my attention.
Only a few years ago, building profiles like these would have required extensive research. Now it takes only an upload.
Unsettlingly, much of the data users inadvertently share stems from the accumulated context they build as they ‘play’ with chatbots.
As Eamonn Maguire, Director of Engineering at Proton, tells TechRadar: “Even when a user never disclosed certain facts directly, these can often be estimated from patterns in their interaction — approximate age, income bracket, education level, or political leanings.”
Even writing style and tone work against you. They can reveal both socioeconomic profiles and psychological states, including stress levels, mood, and moments of vulnerability.
The cost? My data carried a specific (and substantial) price tag with intrinsic value that companies can profit from.
Indeed, once it leaves the platform — whether it is combined with other datasets for advertising, training, or sharing purposes beyond what is necessary for the basic functioning of large language models (LLMs) — personal data risks being permanently compromised. That leaves users with very few means of protecting it at all.
Are some chatbots worse than others?
It’s fair to assume the majority of LLMs are data treasure troves. They absorb our details as we freely offer them, and it’s too tempting for their owners not to profit.
Incogni’s data privacy ranking 2026 scored 13 AI platforms based on the privacy risks they pose. “It’s less a case of which is the most privacy-friendly platform but rather which is the least privacy-invasive platform,” Senior Communications Manager at Incogni, Bogan Popescu, told TechRadar.
Meta AI, Gemini, and Copilot were the worst. Incogni points to sprawling privacy policies covering many products at once, making it hard to pinpoint exactly what applies to the chatbots, together with more extensive data collection or sharing practices overall.
Others, such as Mistral’s Vibe, accumulated fewer risks overall, but they still train on publicly available datasets without disclosing exactly where these come from. “They tell users very little about what information was actually included, whose data may be in there, and how it was obtained,” Popescu told TechRadar.
And while the popular ChatGPT follows Vibe as “the least privacy-invasive platform,” these findings don’t look so comforting in retrospect. Last week’s404Media investigation revealed that humans are actually reading users’ prompts to improve OpenAI’s models.
These firms were contacted but have not responded to our requests for comment on their privacy policies.
NEW: Leave No Trace — A weekly newsletter on digital privacy and online surveillance.
Leave No Trace investigates the companies and governments putting our digital freedom at risk — and the people fighting back.
📩 Subscribe now to get every edition delivered to your inbox every Friday, launching this September.
Do people using AI chatbots even know?
What’s painful is that, rather than LLM providers ‘harvesting’ data, their users are voluntarily sacrificing their privacy.
As DuckDuckGo’s Senior Vice President, Zac Pappis, told me: “Many companies have given the impression that they should be using AI for everything.”
Combine that context with a conversational voice and veneer of expertise, and people assume a level of safety and anonymity that most AI chatbots just don’t offer.
That’s exactly what DuckDuckGo’s recent report unveils, in fact. A survey conducted on nearly 2,000 American adults found that more than a third of AI users have shared information that they kept from close friends, parents, or medical professionals.
Worse still, over half of those surveyed didn’t know or were unsure whether their chatbot conversations had been used for training. “For most companies, it’s to their benefit that people don’t realise where their data is going,” Pappis stresses.
Why deleting your AI chats isn’t enough
Deleting everything might be your first instinct now, but will this solve the problem? Not quite. A clear front-end is just that — a clear facade.
Copies persist in places deletion doesn’t reach — backup logs and disaster-recovery systems that can hold data for months, server logs recording interactions, third-party processors like cloud or moderation infrastructure, and most consequentially, derived artifacts.
“The last one matters the most,” Maguire from Proton told me. If a conversation has already contributed to trained models, embeddings, or aggregated analysis before deletion, removing the conversation afterwards doesn’t undo what the model has already learned about you.
Deletion itself might not even be immediate, as many providers retain data post-deletion for abuse investigation, legal compliance, or simply operational lag.
Assume anything you write could be seen by someone other than you
Opting out of conversation training doesn’t solve this problem either. Platform settings might retain conversations, uploaded files, account information, and usage patterns for extended periods regardless.
Platforms often use your data for purposes beyond improving models, including targeted advertising — which ChatGPT has recently introduced. “So there is an important distinction between ‘my conversations aren’t being used to train the model’ and ‘the service isn’t retaining or processing my data’,” Maguire explains.
Furthermore, Incogni research found that no platform currently enables users to remove data once already used for model training, making opt-outs prospective rather than retroactive. “Make no mistake: your deepest secrets are being actively used to train the platform to respond to someone else’s closely similar query tomorrow,” Popescu says.
In fact, opt-outs can create a dangerous illusion of control. Disabling training only shields the text inside the chat window, while background data harvesting continues regardless.
How to use AI chatbots more privately
Most experts share similar advice for LLM users, and it starts with a constraint.
“Think about the cumulative effect of conversations rather than treating every prompt as an isolated interaction, and assume anything you type could potentially be seen by others,” Maguire from Proton says.
Popescu at Incogni agrees. “Every month, we see how malicious agents — whether human or AI — could still hijack the conversation. In practice, that means you should assume anything you write could be seen by someone other than you.”
Also, while reviewing privacy policies and data controls to understand Big Tech’s information collection and use is important, switching to AI services designed with stronger privacy protections might simply be safer.
Proton’s Lumo, for instance, claims to keep no conversation logs after processing, use zero-access encryption for saved chat histories, and not train on conversations.
The open-it doesn’t train with user chats, while Internxt is also clear that all chats are stored locally on your device
These tools, and similar ones, can be excellent allies in safeguarding digital privacy, and we expect their popularity to only grow over time.
If you are sticking with the major players, though, at least favour the browsers over mobile apps, as apps often require more device data and share it with third parties, stresses Popescu.
His ask for the future of regulations is simple, and while it probably won’t happen anytime soon, we hold out hope for it, too — a verifiable ‘Right to be forgotten’ as standard.
No one wants their diary read. Our new digital journals should be no different.
