Someone asked me after a workshop whether the AI chatbot she'd been using was "listening" to her the way she worried her phone was, and whether anything she typed was showing up somewhere she couldn't see. It's a fair question, and one I think more people should ask before, not after, they've typed something sensitive in.
Here's the plain version, without getting into the technical weeds: when you type into an AI chatbot, that text gets sent to the company that runs it, generally the same way an email gets sent to whoever receives it. Most of the major companies publish privacy policies explaining what they do or don't keep, and many offer settings letting you turn off having your conversations used to improve their systems. It's worth actually reading that policy, or asking the AI itself to summarize its own company's privacy policy in plain English — which it can usually do, ironically enough.
A good rule of thumb that works regardless of which company or app you're using: treat an AI chatbot the way you'd treat texting a friend who works for a company you don't fully know the inner workings of. Perfectly fine for a huge range of everyday questions and drafts. Not the place to type your full social security number, your bank passwords, or anything you'd be uncomfortable with a stranger somewhere possibly seeing in a data breach down the road.
This isn't meant to scare anyone off — I use these tools daily, for a lot of real and useful things. It's meant to put you in the same sensible mindset you already have about email or online forms: use good judgment about what actually needs to go in that box, and everything else is fair game.
If you want the slow, no-jargon version of all this — the stuff I wish someone had handed me before I fumbled through it myself — that's exactly what I built On Ramp AI for. Check it out here.