Claude

Is Claude safe?

Claude is a reasonable risk for everyday questions, but it is not a private notebook. Anthropic trains its models on consumer chats unless you switch that off, keeps them for up to five years when training is on, and holds flagged conversations for two years. The weak spot is your account: there is no password, passkeyPasskeyA way to sign in without a password. Your device holds a key tied to one website or app and unlocks it with your fingerprint, face or PIN.More in the glossary or documented second factor, only a Google sign-in or an emailed link. In July 2026 chats people had shared with a link turned up on Google. We score it 60/100, level with Google Gemini and a little above ChatGPT.

Does Claude train on your chats?

Yes, unless you opt out. Anthropic's privacy policy, effective 10 September 2026, says it may use your inputs and outputs to train its models "unless you opt out through your account settings". This covers the Free, Pro and Max plans, including Claude Code. Team, Enterprise, education, government and API customers are not trained on.

Until August 2025 Anthropic did not train on consumer chats. When it announced the switch on 28 August 2025, existing users saw a pop-up with a large "Accept" button and a smaller training toggle that TechCrunch found already set to "On". Anthropic's Privacy Center still describes training as something "you choose to allow", which is a kinder reading than the policy itself.

Even with training off, Anthropic still uses chats its systems flag for safety review, and any conversation you rate with thumbs up or down is stored whole for five years and can be used for training. Turning the setting off stops future training runs but does not remove your data from models already trained.

What Anthropic keeps

Anthropic's retention rules:

Situation	How long it is kept
You delete a chat	Removed from history at once, from back-end systems within 30 days
Training switched on	Up to 5 years, de-identified, in training pipelines
Incognito chat	30 days, not used for training
Chat flagged by safety systems	Up to 2 years; safety classification scores up to 7 years
Feedback and bug reports	5 years

Chats are not end-to-end encryptedEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary, so Anthropic can read them. The privacy policy says flagged material is separated from your user ID for training but can be re-identified to enforce its rules.

Apple's label lists coarse location, contact details, photos and other content, user and device IDs, product interaction and diagnostics as linked to you, and lists several of them for Anthropic's own advertising or marketing. Google Play says email, user IDs, phone number, app interactions, crash data and approximate location are shared with other companies, mainly for analytics and fraud prevention. Anthropic says it does not sell personal data.

Security and incidents

We found no report of an attacker stealing private, unshared Claude chats. The weaker point is login. Anthropic's help centre offers only Google sign-in or an emailed one-time link, says you cannot set a password, and describes no passkeyPasskeyA way to sign in without a password. Your device holds a key tied to one website or app and unlocks it with your fingerprint, face or PIN.More in the glossary or authenticator option, so your Claude account is only as safe as the email or Google account behind it. Anthropic's ISO 27001 and SOC 2 certifications are listed for its commercial products, not specifically for consumer plans.

Four episodes in 2026 are worth knowing:

• 31 March: a moderate-severity flaw (CVE-2026-22561) in the Claude for Windows installer before version 1.1.3363 allowed local privilege escalation by planting a malicious DLL next to the installer.
• 31 March: Anthropic accidentally published the full source code of Claude Code, its coding tool, through a 59.8 MB source map file in a public npm package. Security firm Zscaler then found fake "leaked Claude Code" downloads that installed malware.
• 27 July: TechCrunch reported that chats and Artifacts shared with a public link could be found on Google. Some reportedly held health records, internal company documents and children's names and phone numbers. Anthropic said links appear in search only if users post them publicly. By the time the article ran, TechCrunch's own test searches no longer found them. TechCrunch noted a smaller, similar episode in 2025.
• 30 July and 9 September: Anthropic disclosed four incidents in which Claude models, running without the safeguards used in the app, reached the internet through a misconfigured third-party evaluation environment and broke into real organisations' systems. In one case they reached a database with several hundred rows of production data. No consumer accounts were involved, but Anthropic called the incidents "serious".

Minors and harmful content

Claude is for adults. Anthropic's terms require users to be at least 18, and users confirm their age at sign-up. When Anthropic detects signs that an account belongs to someone under 18, it disables it and offers age verification through Yoti. There is no teen version and there are no parental controls. Apple rates the app 18+, but Google Play rates it Teen in the US, which does not match the terms.

When Anthropic's classifier spots talk of suicide or self-harm on Claude.ai, a banner points the user to helplines. Anthropic's own threat reports describe criminals using Claude for a data-extortion campaign against at least 17 organisations (2025) and to build fake dating apps that defrauded people (December 2025 to August 2026). Anthropic says it disrupted these. For most users the everyday risk is a confident wrong answer on health, legal or money questions.

Regulators and courts

We found no privacy fine or data protection order against Claude. The big case is about copyright. In Bartz v. Anthropic, authors said Anthropic downloaded their books from the pirate sites Library Genesis and Pirate Library Mirror. In June 2025 the court ruled that training on books was fair use but left the downloads for trial. Anthropic settled for $1.5 billion, about $3,000 per work, without admitting wrongdoing, and the court gave final approval on 20 July 2026. On 30 September 2026 an FTC spokesperson confirmed an investigation into Anthropic, OpenAI and other AI companies over risks to consumers. No findings have been announced.

Settings worth changing

1. Settings > Privacy: switch off "Help improve our AI models".
2. Use an incognito chat (the ghost icon) for anything sensitive, knowing it is still kept for 30 days.
3. Do not rate chats that contain personal details. Feedback stores the whole conversation for five years.
4. Review and revoke public links under Settings > Privacy > Shared Chats.
5. Turn on two-step verificationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary for the email or Google account you sign in with, because that is Claude's only lock.

How we scored it

Transparency and control (65) and security (64) are Claude's strongest factors, and neither is high: retention is clearly documented, but training is on unless you opt out and login has no second factor of its own. Privacy (56) is held down by default training and long retention, and regulatory record (55) by the $1.5 billion copyright settlement and the open FTC investigation.