Is Claude private? What Anthropic keeps, trains on, and can hand over

The Morse teamPublished October 15, 202610 min read

Claude is private from other people, but not from Anthropic. As of October 2026, Anthropic keeps your Claude chats on its servers, trains on them if your training setting is on (and then keeps them for up to five years), lets designated safety staff read flagged chats, and shares data when the law requires it. In February 2026, a federal judge ruled that a defendant's Claude chats weren't protected by attorney-client privilege.

That doesn't make Claude careless. Anthropic publishes unusually specific retention periods, and its business terms rule out training. But the consumer app (Free, Pro, and Max) changed a lot between August 2025 and September 2026, and many guides still describe the old rules. Here's what's true now, with every claim linked to Anthropic's own pages or the court record.

Does Claude train on your data?

Yes, if your training setting is on, and for existing users that switch started out on. On August 28, 2025, Anthropic changed its consumer terms: Free, Pro, and Max users, including Claude Code on those accounts, had to choose whether their chats and coding sessions could be used to train Claude. Before that, consumer chats weren't used for training by default.

TechCrunch reported that existing users saw "a prominent black 'Accept' button with a much tinier toggle switch for training permissions below in smaller print," and that the toggle was "automatically set to 'On.'" The deadline was first September 28, 2025, then moved to October 8, 2025.

Today Anthropic's privacy policy says: "We may use your Inputs and Outputs to train and improve Anthropic AI models, unless you opt out through your account settings." Three exceptions apply even with training off, per Anthropic's training page:

• Flagged chats. Conversations "flagged for safety review" may be used to improve how Anthropic detects and enforces violations of its Usage Policy.
• Thumbs up or down. Rating a reply means "we will store the entire related conversation" for up to five years, and it may be used for training.
• Programs you join, such as Anthropic's Trusted Tester Program.

How to check your setting

On the web or desktop app, open the menu under your name, choose Settings, then Privacy, and find the toggle under "Help Improve our AI models." The mobile app has the same path (Anthropic, as of August 2026). Turning it off stops future use of your new and stored chats, but chats already used in a training run that has started, or in a model already trained, stay there.

How long does Anthropic keep your Claude chats?

The 30-day figure for chats with training off comes from the 2025 announcement, which said people who opt out "continue with our existing 30-day data retention period" (Anthropic). Anthropic's current retention page is more exact, and ties the 30 days to deletion: when you delete a chat, it's "removed from your chat history immediately" and "deleted from our back-end storage systems within 30 days" (Anthropic). A chat you never delete stays in your history, and the policy's general rule is that Anthropic keeps personal data "for as long as reasonably necessary" (privacy policy).

Every retention period Anthropic publishes, read on October 15, 2026:

Incognito chats, started from the ghost icon at the top of a new chat, are the most private option inside Claude itself. They still sit on Anthropic's servers for a month.

Does Anthropic read your chats?

Not by default, with two exceptions. Anthropic says "by default, Anthropic employees cannot access your conversations unless" you share them as part of feedback, or a review is needed to enforce its Usage Policy, in which case "only designated members of our Trust & Safety team may access this data on a need-to-know basis" (Anthropic, dated March 2026).

If training is on, a third group sees your chats in some form. Anthropic says it de-links them "from your user ID (like your email address) before any review," and that "access is limited to a small number of personnel involved in model training" (Anthropic). De-linking removes your email but leaves your words as they are. If you named your employer, your doctor, or yourself in the chat, those words are still there.

A timeline of Claude's privacy terms, August 2025 to October 2026

• August 28, 2025. Anthropic announces the training choice for Free, Pro, and Max: five-year retention with training on, the existing 30-day retention with it off. The change applies only to new or resumed chats (Anthropic).
• October 8, 2025. The new consumer policy takes effect, after the September 28 date was pushed back (change log).
• January 12, 2026. Anthropic adds a Consumer Health Data Privacy Policy for users in some US states who connect health apps (change log).
• February 10 and 17, 2026. A federal judge rules that a defendant's Claude chats aren't privileged, then files his reasons (more below).
• July 8, 2026. An update announced June 8 takes effect for consumer accounts. It covers data shared with third-party apps you connect and during multi-step tasks, "Verification Data" when Anthropic asks you to confirm your age or identity, and data from research studies you join. The summary also says "We don't sell your data" and "Claude remains ad-free" (change log).
• September 10, 2026. The privacy policy now reads "Effective September 10, 2026," with the July 8 version archived. As of October 15, 2026, Anthropic's change log has no summary for this version, so we can't tell you what changed.

On Verification Data, the current policy says that "in certain circumstances, we may ask you to verify your age or identity," and that if you choose to verify, the data can include an image of your government ID, your image in photo or video form, and facial geometry templates (policy). It doesn't say how often Anthropic asks.

What do Anthropic's Commercial Terms cover instead?

The training choice never applied to Anthropic's business products: Claude for Work (Team and Enterprise), Claude Gov, Claude for Education, and the API, including through Amazon Bedrock and Google Cloud's Vertex AI (Anthropic). Those run under the Commercial Terms, which say: "Anthropic may not train models on Customer Content from Services."

Retention is shorter too. For the API, Anthropic says "we automatically delete inputs and outputs on our backend within 30 days," and it offers zero data retention to eligible customers (Anthropic, as of July 2026). One exception: for its most capable "covered" models (the Mythos class), Anthropic says prompts and outputs "are retained for 30 days to support our safety work, on every platform where these models are offered," so zero-retention customers have to turn retention on to use them (Anthropic, effective June 9, 2026).

These terms are for organizations. A person who signs up at claude.ai gets the consumer terms, whatever they pay.

Can your Claude chats be used against you in court?

They have been. In United States v. Heppner, a securities fraud case in the Southern District of New York, Judge Jed S. Rakoff ruled from the bench on February 10, 2026, that a defendant's written exchanges with Claude were protected by neither attorney-client privilege nor the work product doctrine. His memorandum, filed February 17, called it "a question of first impression nationwide."

What happened, from the memorandum:

• When the defendant was arrested in November 2025, FBI agents searched his home under a warrant and seized documents and devices. Among them were about 31 documents recording his conversations with Claude.
• He had used Claude on his own, after getting a grand jury subpoena, to outline a defense strategy. His lawyers conceded they "did not direct" him to use it.
• The judge's first reason was simple: "Because Claude is not an attorney, that alone disposes of Heppner's claim of privilege."
• His second was Anthropic's own privacy policy. The court noted that the policy users agree to says Anthropic collects inputs and outputs, uses them to train Claude, and may disclose them to "third parties," including "governmental regulatory authorities." So there was no reasonable expectation of confidentiality.

The chats weren't subpoenaed from Anthropic. Agents seized them from the defendant's own home, so what's on your devices matters as much as where your history is stored. Anthropic's own guidance for legal work (August 2026) argues the ruling "turned on the consumer privacy terms and the absence of attorney direction," and points to later decisions that reached protective outcomes. None of them came from an appeals court. Orrick's analysis is a good plain-English read. This is not legal advice; if you're in a legal matter, ask your lawyer before you ask any AI. We cover the wider question in can AI chats be subpoenaed.

How do you use Claude anonymously, without an Anthropic account?

Not through Anthropic. Its help center says "we require phone verification for all new users, and there isn't a way to skip this step," and it doesn't accept VoIP numbers, Google Voice, or app-generated numbers (Anthropic, as of August 2026). So a Claude account is tied to a phone number, an email, and whatever you pay with.

The way around it is an app that sends your messages to Claude under its own account, so Anthropic sees the app's account, not yours. DuckDuckGo's Duck.ai works this way: it offers Claude 4.5 Haiku free, Claude Sonnet 4.6 on its Plus plan, and Claude Opus 4.8 on Pro, "anonymized by us" (DuckDuckGo). It says your IP address "is not exposed" to model providers and that its agreements require them to delete data "at most within 30 days, with limited exceptions for safety and legal compliance" (DuckDuckGo, updated October 1, 2026).

Morse works this way too, and it's built around the rest of what this article covers: training, retention, staff review, and chat history that a court can reach.

How Morse keeps your Claude chats private

Every problem above starts with your chats sitting on Anthropic's servers, tied to an account with your phone number, email, and payment details. Morse is a web app with over 30 models, open and closed, in one place, and it's built so your chats don't sit anywhere but your own device. Each chat has a privacy mode, so you choose how private each conversation is:

• Anonymous, to use Claude without Anthropic knowing it's you. Morse's proxy removes your account, email, and IP address and sends your message under Morse's own account. There's no Anthropic account, no phone number, and no training toggle to find. Claude sees the question with your identity stripped, and Anthropic may keep it for a limited time to check for abuse, under its own policy. Morse strips who you are but not what you write, so leave names and details you'd rather keep to yourself out of the message. The Free plan includes Claude Haiku 5.5, within 15 messages a day shared with GPT-6 Luna, GLM 5.3 Flash, and more; paid plans start at $19 a month.
• Private, for anything you'd rather no host keep. It's the default for a new chat. Open-weight models like DeepSeek, Kimi, and GLM, plus Grok, run on hosts that have agreed to zero data retention. Where a host confirms that on each reply, Morse checks it and refuses a reply that doesn't.
• E2EE, for anything no one should read. Start the chat in E2EE and pick an open-weight model. Your browser checks the secure enclave's proof that it's genuine before anything leaves your device, then encrypts each message so only that verified enclave can open it. Morse's servers relay text they can't read, and the reply is opened only in your browser. E2EE chats come with Pro, at $19 a month. Read how end-to-end encrypted AI chat works.

In every mode, your chat history is stored only in your browser, encrypted, not on Morse's servers. Morse doesn't train AI on your chats, sell your data, or show ads (Morse privacy policy). There's no training setting to get right, and no chat history on our servers for anyone to request. Because we don't store chats, we usually have very little to give authorities. Your history is locked when you sign out and takes two keys to open, one that never leaves your device and one our server gives you when you sign in, so a copy of your browser data alone can't be read. Deleting a chat or clearing your browser deletes it for good, with no copy on our servers left behind. For a question you don't want saved anywhere, a Temporary chat is never saved, not even on your device.

So is Claude private enough for you?

It depends on who you're hiding from:

• Other people: fine, as long as you don't share links to chats you'd want kept.
• Model training: in Claude, turn off "Help Improve our AI models," don't rate replies, and use incognito chats for anything sensitive. On Morse, there's nothing to turn off, because it doesn't train on your chats.
• Anthropic itself: you can't hide your words from the company running the model, but you can keep your name off them with Morse's Anonymous mode. For words no company should read, use an open-weight model in E2EE.
• A court or investigator: assume anything you type, on any service, could be read back to you someday. Keeping your history off company servers, encrypted on your own device, limits what there is to reach.

For the same questions about other assistants, see does ChatGPT train on your data and our comparison of whether AI chats are private.

Try a chat from the Morse home page without an account, or start free and use Claude without your name attached.