Take Back
Your Data

Free your data from ChatGPT

1. Log into ChatGPT.
2. Go to Profile → Settings → Data Controls → turn off “Improve the model for everyone.” (OpenAI's help article)

This only stops future conversations from training the model. It doesn’t touch what’s already in your history — for that, go to Settings → General → Delete all chats.

Thinking of using Temporary Chat instead? It skips your history and isn’t used for training or memory, but OpenAI still holds onto it behind the scenes for up to 30 days for safety and abuse monitoring. Not quite the vanishing act the name suggests.

While you’re in Data Controls, you’ll also find:

• Export your data — get a copy before you delete anything
• Delete your account
• Manage Memory — what ChatGPT remembers about you between chats
• Privacy Portal — for formal data requests

Why some Kiwis are looking at Claude instead

If you’re weighing up ChatGPT against Anthropic’s Claude, here’s the honest comparison rather than the sales pitch:

• Both now default new users into a choice, not a free pass. ChatGPT’s “Improve the model for everyone” and Claude’s “Help Improve Claude” are both toggles you have to actively manage.
• Both have a genuine incognito/temporary mode, and on both, that mode is excluded from training even if your main account setting says yes.
• Anthropic states that, by default, staff can’t access your individual conversations without your consent or a safety flag on the content (Anthropic's Privacy Center) — a more explicit access restriction than OpenAI publishes.
• Retention shapes are similar: opt into training on either platform and your data can be kept for years. Opt out or delete, and both still keep a shorter backend copy (roughly 30 days) for safety and fraud checks first.
• For business and API accounts, both companies say they don’t train on customer data by default, so this mostly matters for personal, free-tier use.

Bottom line: switching to Claude isn’t a shortcut to zero data collection. Run the same audit either way — training off in Privacy Settings, Incognito for anything sensitive.

Prices below are labelled by check date rather than stated as fixed, since they drift.

Free tools (unchanged — all confirmed working in NZ Jul 26)

Paid data removal services (pricing checked July 2026)

The order that protects you, 2026

1. Passkey, wherever the service offers one.
2. No passkey? A unique password generated and stored by a password manager.
3. Phishing-resistant MFA or a physical security key, where offered.
4. An authenticator app (TOTP codes), if no security key option exists.
5. SMS codes — only as a last resort. Better than nothing, easiest of these to intercept.

Why length beats cleverness

US NIST, the standards body most password guidance leans on, has shifted its advice: password managers and phishing-resistant authentication now matter more than symbol rules. A single-factor password should be at least 15 characters. A genuinely random four-word passphrase beats a clever eight-character substitution — length is what actually slows a brute-force attack, and a password manager means you never have to remember either.

Password managers for Kiwis, 2026

Note: Apple now presents this as its own Passwords app rather than folding it entirely into Settings — the underlying iCloud Keychain sync is the same.

Should you ditch “Sign in with Google/Apple”?

Not necessarily. “Switch back to email and password because it’s more secure” isn’t generally true. Signing in with Google or Apple avoids creating another reusable password, and it usually grants the app a defined, visible set of permissions rather than blanket access.

The better move isn’t abandoning it wholesale — it’s auditing it:

• Review exactly what permissions each connected app has requested.
• Remove anything old, unused, or unrecognised.
• Protect the identity-provider account itself with a passkey or strong MFA — it’s now the single key to everything connected to it.
• Remember: revoking access stops future data flow, it doesn’t delete what the other service already copied. Contact that service directly for that.

Android

The old “Opt out of Ads Personalisation” path is being phased out on newer versions. Current path: Settings → Privacy → Ads → Delete advertising ID — this removes the identifier itself rather than just opting out of its use. Also check your Privacy Dashboard and My Ad Center for what’s actually been inferred about you.

iPhone

• App Privacy Report (Settings → Privacy & Security → App Privacy Report) shows exactly what each app has accessed, and when.
• Safety Check (Settings → Privacy & Security → Safety Check) quickly cuts off everyone and everything with access to your device and accounts.

Browser: uBlock Origin

Full uBlock Origin no longer works properly on Chrome — Google’s Manifest V3 changes removed the capability it relies on. If ad and tracker blocking is a priority, install full uBlock Origin on Firefox. Staying on Chrome or Edge, install uBlock Origin Lite instead — real, but reduced filtering power. Get either from the developer’s own site or your browser’s official extension store, not a generic promotional domain.

Here’s what New Zealanders can actually ask for, and what changed in 2026.

What you can ask for under the Privacy Act

• Ask any organisation what personal information they hold about you. They generally have 20 working days to respond.
• Ask them to correct it — including asking them to delete it — though NZ doesn’t have a broad GDPR-style “right to be forgotten.” These are requests you can make, not guarantees you’ll get.
• If they refuse to correct something, ask them to attach a statement of correction so your version sits alongside theirs.
• Not getting anywhere? Contact the organisation’s privacy officer, then escalate to the Office of the Privacy Commissioner.

IPP 3A — in force from 1 May 2026

Organisations generally now have to tell you when they’ve collected personal information about you from someone other than you — a data broker, another company, a public register — unless a specific exception applies. This closes a long-standing gap where your data could change hands and you’d never know. (Ministry of Justice)

The Biometric Processing Privacy Code

Covers face, voice, fingerprint and other biometric data. In force for new systems since November 2025; organisations already using biometrics before then have until 3 August 2026 to comply. (Office of the Privacy Commissioner)

A few more worth knowing

• Marketing emails and texts: businesses must generally act on your unsubscribe request within five working days. (DIA anti-spam guidance)
• Stalking and harassment: from 26 May 2026, NZ has a stand-alone stalking offence covering digital tracking, spyware and doxxing, not just physical following.
• Doxxing, intimate-image abuse and AI-generated deepfakes: Netsafe has dedicated guidance on doxxing and on image-based abuse, including deepfakes. NZ Police's Harmful Digital Communications guidance covers the criminal side. Screenshot first, with the date and URL visible, then reach out.

You have more say over what shows up about you on Google than most people realise, it just depends which lever you pull. Here are the three that actually exist:

1. Remove it at the source. Contact whoever runs the site or platform and ask them to take it down. The only option that removes the content itself.
2. Remove it from Google Search. Google can delist certain categories of personal information (phone number, home address, ID numbers) from search results — the original page is still live if someone goes there directly.
3. Refresh outdated content. For pages already updated or taken down at the source, where an old cached version is still showing. Only use once the live page has actually changed or gone — Google's Refresh Outdated Content tool.

The main moves from this guide, in one place. Work through them at your own pace — even three or four of these puts you ahead of most people online.