# The Training-Flag Lockdown Sheet (Chapter 3)

Use this sheet to check the exact account and services your task will use.
Start with the training setting, then complete the other checks before sending
real records. Published material and invented rows let you practice while you
resolve anything missing. Payment is not proof of privacy.

Settings and official help pages checked September 8, 2026. Labels can change;
follow the linked guide for your product and account. These paths were checked
against documentation, not tested inside signed-in accounts.

## 1. Find the training control

These are controls for personal accounts unless stated otherwise. A control for
one product does not automatically cover another app, an API, or a connected service.

- **ChatGPT, web:** profile icon → Settings → Data Controls → turn off
  **Improve the model for everyone**. The account setting also applies on mobile.
  Chats remain in history; Temporary Chats can be retained for 30 days and
  reviewed for abuse. [OpenAI guide](https://help.openai.com/en/articles/7730893-data-controls-faq)
- **Claude, browser or desktop:** Settings → Privacy → turn off
  **Help Improve our AI models**. Anthropic says this consumer setting also covers
  Claude Code sessions on Free, Pro, and Max accounts. Safety-related uses can
  remain. [Anthropic guide](https://privacy.claude.com/en/articles/12109829-how-do-i-change-my-model-improvement-privacy-settings)
- **Gemini, personal account:** open Gemini → Activity → select **On** near
  the top → **Turn off** under Keep Activity. Google can still retain conversations
  for up to 72 hours; available connected apps also change. Work and school
  accounts use different settings. [Google guide](https://support.google.com/gemini/answer/13278892?hl=en)
- **Grok:** on grok.com, Settings → Data → turn off **Improve the Model**.
  On mobile, Settings → Data Controls → **Improve the model**. Feedback can still
  be used for training, and retention and human review remain separate checks.
  Grok inside X has [separate controls](https://help.x.com/en/using-x/about-grok).
  [Grok guide](https://x.ai/legal/faq)
- **Microsoft Copilot:** first identify the version and account. For the older
  Windows/macOS app, profile icon → Settings → Privacy → turn off **Training on
  conversation activity** and **Training on voice conversations**.
  [Older-app guide](https://support.microsoft.com/en-us/microsoft-copilot/microsoft-copilot-privacy-controls)
  Microsoft changed its web and app experience in August 2026; the
  [current personal-account guide](https://support.microsoft.com/en-us/privacy/microsoft-copilot/privacy-controls)
  lists memory, history, and web-search controls, but does not document an equivalent
  training switch. Do not treat a memory toggle as a training opt-out. Use the
  current product terms to complete the checks below. Work/school accounts have
  [separate data protections](https://learn.microsoft.com/en-us/copilot/privacy-and-protections).

If a path is missing, record it as unresolved. An absent switch is not evidence
that training is off. A product can exclude training by default; in that case,
save the applicable terms rather than hunt for a switch it does not offer.

## 2. Check agents, APIs, and connected services

For a terminal agent or an API (a service another program calls), record both the
app you use and the provider it contacts. A local app can still send prompts,
files, and screenshots to a remote model. Check the app's own logs and telemetry
as well as the provider's terms. If you use a model entirely on your machine,
verify that the workflow really stays local, including any search or other tools.

Chat subscriptions and API accounts can have different conditions. Google's
[Gemini API retention guide](https://ai.google.dev/gemini-api/docs/zdr), for example,
distinguishes training from abuse-monitoring logs and feature-specific storage.
A no-training promise does not mean no retention.

Connected apps and external APIs can receive portions of an input. List every
recipient needed for the task and check its terms too. Turn off connections you
do not need. [OpenAI's explanation of third-party routing](https://help.openai.com/en/articles/8554407-gpts-faq)

## 3. Record the answer for this task

- Task and records needed: [purpose; fields needed; fields removed]
- Exact app, provider, account type, and tier: [names; no passwords or keys]
- Other services receiving prompts, files, or screens: [names, or verified none]
- General training: [setting and value, or no-training terms; date checked]
- Exceptions: [feedback, safety review, or other uses described in the terms]
- Retention and deletion: [duration; deletion process; exceptions]
- Human access: [who can review the data, and for what purposes]
- Conditions for these records: [applicable legal or contractual requirements;
  whether this service and account meet them; required agreement if any]
- Evidence: [official terms links and settings notes; date checked]
- Result: [real records suitable for this task / use invented or published material
  until the named unresolved checks are settled]

Keep the completed sheet with Chapter 16's binder. Use the
[data-safety checklist](../checklists/data-safety-checklist.md) before the task.
The sheet records what you checked; it is not a universal certificate for the tool.