Privacy AI Checklist 2026: Is Your AI Usage Secure?
i helped a friend audit his AI privacy last month. he's a developer, uses ChatGPT daily, thought he was "pretty careful." we went through this checklist together. he failed 7 out of 12 checks. pasted API keys into ChatGPT, used his real email, no VPN, credit card statement showing "OPENAI" every month. he fixed most of it in an afternoon.
tl;dr: Most people using AI fail 4-6 out of 12 privacy checks, with the most common issues being real email on ChatGPT, pasting sensitive data into cloud AI, no VPN, and password reuse. Quick wins you can do in 10 minutes include enabling 2FA, turning off ChatGPT training, installing ProtonVPN, and deleting old sensitive conversations. The checklist covers account security, data leakage, payment privacy, network privacy, provider awareness, and tool auditing across 6 categories.
key takeaways:
- Most people fail 4-6 out of 12 privacy checks, with the top issues being real email on ChatGPT, sensitive data in cloud AI, no VPN, and password reuse.
- Quick 10-minute fixes include enabling 2FA, turning off ChatGPT training, installing ProtonVPN free tier, and deleting old sensitive conversations.
- The checklist covers 6 categories: account security, data leakage, payment privacy, network privacy, model provider awareness, and AI tool auditing.
most people using AI have no idea how much data they're leaking. prompts, payment info, IP addresses, usage patterns - it all adds up. here's the checklist i use to audit AI privacy.
category 1: account security
short answer: Account security checks include dedicated privacy-focused email, two-factor authentication, unique passwords, and VPN usage for AI services.
| Check | Status | Risk Level |
|---|---|---|
| Using a dedicated email for AI services? | ☐ | Medium |
| Email provider is privacy-focused (ProtonMail, Tutanota)? | ☐ | Medium |
| Two-factor authentication enabled? | ☐ | High |
| Strong, unique password for each AI service? | ☐ | High |
| No phone number linked to AI accounts? | ☐ | Low |
| Using a VPN when accessing AI services? | ☐ | Medium |
what to fix first
short answer: Fix high-risk items first: stop reusing passwords across AI services, enable 2FA on every account, and use a password manager.
high risk items:
- if you're reusing passwords across AI services, stop. use a password manager (bitwarden, 1password)
- enable 2FA on every AI account that supports it
medium risk items:
- create a dedicated email for AI services (protonmail is free)
- use a VPN (mullvad is $5/month, protonvpn has a free tier)
low risk items:
- phone number linking is hard to avoid on some services (chatgpt requires it)
- consider using a prepaid SIM for verification if needed
category 2: data leakage
short answer: Data leakage checks include not pasting confidential code or personal documents into cloud AI and not sharing API keys or credentials.
| Check | Status | Risk Level |
|---|---|---|
| Not pasting confidential code into cloud AI? | ☐ | High |
| Not pasting personal documents into cloud AI? | ☐ | High |
| Not sharing API keys in prompts? | ☐ | Critical |
| Not pasting credentials/passwords into AI? | ☐ | Critical |
| Training data opt-out enabled (ChatGPT, Claude)? | ☐ | High |
| Conversations deleted after sensitive use? | ☐ | Medium |
| Using local models for sensitive work? | ☐ | Medium |
the API key problem
short answer: Developers constantly paste API keys and database credentials into ChatGPT for debugging, putting them on OpenAI's servers where they can be trained on.
i see this constantly: developers paste API keys, database credentials, and environment variables into ChatGPT to "debug" them. don't do this. ever.
those credentials are now on openai's servers. even if you delete the conversation, the data might already be in the training pipeline.
the fix: use local models for anything involving credentials. ollama runs on your machine - no data leaves.
the document problem
short answer: Pasting legal documents, medical records, or business plans into cloud AI stores them on provider servers where they can be subpoenaed.
pasting legal documents, medical records, financial statements, or business plans into cloud AI is a privacy nightmare. the content is stored, potentially trained on, and accessible via subpoena.
the fix: for sensitive documents, use ollama. for non-sensitive documents, NanoGPT is acceptable (they don't train on data).
category 3: payment privacy
short answer: Payment privacy checks include AI subscriptions not visible on your main credit card and using crypto for AI payments.
| Check | Status | Risk Level |
|---|---|---|
| AI subscriptions not visible on main credit card? | ☐ | Medium |
| Using crypto for AI payments? | ☐ | Low |
| Using no-KYC crypto purchases? | ☐ | Low |
| No recurring subscriptions (pay-per-use preferred)? | ☐ | Low |
payment trail audit
short answer: Check your credit card statement for OPENAI, ANTHROPIC, or GOOGLE charges that reveal which AI tools you use to anyone with statement access.
check your credit card statement right now. do you see any of these?
- "OPENAI" - ChatGPT Plus
- "ANTHROPIC" - Claude Pro
- "GOOGLE" - Gemini (if separate from other google charges)
if yes, anyone with access to your statements knows exactly which AI tools you use.
the fix: switch to crypto payments. NanoGPT accepts monero, bitcoin, and nano. pair with no-KYC exchanges for maximum privacy.
see our AI tools that accept crypto guide for setup instructions.
category 4: network privacy
short answer: Network privacy checks include using a no-log VPN like Mullvad, preventing DNS leaks, and not using AI on public WiFi without VPN.
| Check | Status | Risk Level |
|---|---|---|
| Using a VPN when accessing AI services? | ☐ | Medium |
| VPN provider is no-log (Mullvad, ProtonVPN)? | ☐ | Medium |
| DNS leaks prevented (check ipleak.net)? | ☐ | Medium |
| Not using AI on public WiFi without VPN? | ☐ | High |
| Browser fingerprinting minimized? | ☐ | Low |
VPN setup for AI
short answer: A VPN hides your IP address from AI providers, with Mullvad at $5 per month or ProtonVPN free tier recommended.
a VPN hides your IP address from AI providers. this prevents them from linking your AI usage to your location and identity.
recommended VPNs:
- Mullvad - $5/month, no email needed to sign up, accepts crypto
- ProtonVPN - free tier available, based in switzerland
- IVPN - $6/month, accepts monero
avoid free VPNs (except protonvpn's free tier). most free VPNs sell your data, which defeats the purpose.
browser fingerprinting
short answer: AI providers can track you without an account using browser fingerprinting, minimized by using Firefox with strict settings and uBlock Origin.
AI providers can track you even without an account using browser fingerprinting. to minimize this:
- use firefox with strict privacy settings
- install uBlock Origin
- disable javascript on sites you don't trust
- use container tabs for AI services
category 5: model provider awareness
short answer: Provider awareness checks include knowing which model processes your prompts, understanding retention policies, and using API access over web interfaces.
| Check | Status | Risk Level |
|---|---|---|
| Know which model provider processes your prompts? | ☐ | Medium |
| Understand each provider's data retention policy? | ☐ | Medium |
| Using API access instead of web interfaces? | ☐ | Low |
| Aware of third-party data sharing policies? | ☐ | Medium |
provider data practices
short answer: OpenAI retains data 30 days after deletion with training opt-out, Anthropic API does not train by default, and local models have zero retention.
| Provider | Retention | Training | Third-Party Sharing |
|---|---|---|---|
| OpenAI (ChatGPT) | 30 days after delete | Yes (opt-out) | Yes (service providers) |
| Anthropic (Claude) | 30 days after delete | API: No, Web: Yes | Limited |
| Google (Gemini) | Varies | Yes | Extensive |
| NanoGPT | Minimal | No | No |
| Ollama (local) | Zero | No | No |
the difference between API and web access matters. when you use NanoGPT, your requests go through the API, which typically has better privacy terms than web interfaces.
category 6: AI tool audit
short answer: Tool auditing checks include reviewing privacy policies, minimizing AI services, removing broad-permission extensions, and maintaining a deletion schedule.
| Check | Status | Risk Level |
|---|---|---|
| Reviewed privacy policy of each AI tool used? | ☐ | Medium |
| Minimized number of AI services used? | ☐ | Low |
| No AI browser extensions with broad permissions? | ☐ | High |
| AI tools not integrated with work accounts (unless approved)? | ☐ | High |
| Regular data export and deletion schedule? | ☐ | Low |
browser extension risk
short answer: AI browser extensions often have access to everything you type, including passwords, emails, and confidential documents.
AI browser extensions (grammar checkers, summarizers, writing assistants) often have access to everything you type. including passwords, emails, and confidential documents.
audit your extensions:
- open your browser's extension manager
- check each AI-related extension's permissions
- remove any that have "access to all websites" permissions
- if you must keep them, disable them on sensitive sites
work account integration
short answer: AI tools integrated with work accounts like Slack AI or Notion AI may give your employer access to your AI interactions.
if you use AI tools integrated with your work account (slack AI, notion AI, copilot), your employer may have access to your AI interactions. check your company's AI policy before using these tools for anything sensitive.
scoring your privacy
short answer: Count your high or critical risk items: zero to two is good, three to five is moderate risk, and six or more means significant exposure requiring immediate fixes.
count your red (high/critical risk) items:
- 0-2 red items: good shape, fix the remaining items
- 3-5 red items: moderate risk, prioritize the critical items
- 6+ red items: significant exposure, start fixing now
most people i've helped audit score 4-6 red items. the most common issues:
- using chatgpt with real email and credit card
- pasting sensitive data into cloud AI
- no VPN usage
- password reuse across AI services
quick wins (fix in 10 minutes)
short answer: Quick 10-minute fixes: enable 2FA on all AI accounts, turn off ChatGPT training, install ProtonVPN free tier, and delete old sensitive conversations.
- enable 2FA on all AI accounts (5 minutes)
- turn off training in ChatGPT settings (1 minute)
- install a VPN - protonvpn free tier (3 minutes)
- delete old conversations containing sensitive data (5 minutes)
medium effort (fix this week)
short answer: Medium effort fixes this week: create a ProtonMail account, switch to NanoGPT with crypto, set up Ollama for sensitive work, and audit browser extensions.
- create a protonmail account for AI services
- switch to NanoGPT with crypto payment
- set up ollama for sensitive work
- audit browser extensions
long term (fix this month)
short answer: Long-term fixes: migrate to privacy-focused alternatives, set up a deletion schedule, establish a privacy AI workflow, and learn about data retention practices.
- migrate all AI usage to privacy-focused alternatives
- set up a regular data deletion schedule
- establish a privacy AI workflow (local for sensitive, cloud for general)
- educate yourself on AI data retention practices
Last updated: July 2026
Related Articles
- ChatGPT Data Privacy - what openai collects
- AI Data Retention Comparison - who stores what
- Anonymous AI Chat - no-account options
- Local LLM Guide - maximum privacy setup
- AI Tools That Accept Crypto - anonymous payment
- Privacy AI for Journalists - source protection
Disclosure: Some links on this page are affiliate links. We earn a small commission if you sign up through our NanoGPT referral link, at no extra cost to you. We only recommend tools we actually use and trust.