Audit Claude Household Privacy

Audit a shared Claude account's privacy, Memory, retention, and export settings.

Introduction

30 Second Summary

A shared household account can quietly collect every part of family life. One person's privacy choice can affect everyone at the kitchen table.

In this project, you will audit a shared Claude account with household consent as your starting point. You will create one Settings Record that proves what you chose during the audit.

What You'll Build

At minute 60, you will open a finished Settings Record that proves how your shared account was reviewed without exposing private household details.

By the end of this project, you'll have:

A four-column Settings Record you can read aloud to verify each observed choice. Every row shows its date. Every row names its official page.
A complete proof section with the Memory topic count. It shows all seven retention clocks. Timed searches provide deletion evidence. The export request time proves when preservation began. The minute-50 chat counts capture the real case.
A private local copy that keeps the family list inside the lab folder. A redacted Claude Project copy removes household details. The export stays outside the Project.
Secret Mission: An optional challenge to push your privacy-audit skills further.

Are there any prerequisites?

You need Claude Max access in the app or a browser. Any laptop works. No API key is needed.

Before We Start

A shared account can hold several parts of household life. This step puts privacy boundaries in place before the audit begins.

You will confirm Claude Max access on your laptop. You will also confirm that pay-as-you-go is off.

The full audit stays in a local lab folder. Only a redacted Settings Record may later enter a Claude Project.

In this step, get ready to:

Confirm Claude Max access without additional pay-as-you-go usage.
Prepare the local lab folder for private audit materials.
Define what remains local versus what can enter Claude.

Confirm your private setup

This check does not purchase anything. It confirms that the project uses your existing Claude Max access.

Use a browser or the Claude app on your laptop to sign in to your account.
Open the account area that shows your current plan.
Confirm the current plan is Claude Max.
Open the account area that shows usage billing.
Confirm pay-as-you-go is off.

You should see Claude Max as the active plan. You should also see that pay-as-you-go is off.

Can't confirm your access?

A missing Claude Max plan means the project prerequisite is not ready.

Check that you signed in to the intended account.
Confirm pay-as-you-go remains off before continuing.

Help me check my Claude Max access without changing billing.

Prepare the local lab folder

The local folder separates private material from anything Claude can see. It becomes the home for the full Settings Record.

Use your laptop's system search to open its file manager.
Select the Desktop location in the file manager.
Create a new folder on the Desktop.
Name the folder lab.
Open the lab folder.
Confirm the lab folder is empty.

You have your first safeguard in place. The empty lab folder is now the private home for every full audit artifact.

Local Lab Folder

The folder is available for the full Settings Record. It also holds consent notes.

Any locally saved text stays here. Any received account export stays here.

No household details have been entered into Claude.

Lock in the audit boundary

Privacy by default means starting with the lower-data setting. Local storage is the starting boundary for this audit.

Redacted means private household details have been removed. A Claude Project receives only that cleaned Settings Record later.

Keep every name inside the lab folder.
Keep every family detail inside the lab folder.
Keep every consent decision inside the lab folder.
Keep every account export inside the lab folder.
Place only a redacted Settings Record in a Claude Project later.
Make every account choice yourself.
Perform every chat deletion yourself.

Before you check the boundary, predict which audit item can enter a Claude Project later.

Compare your answer with the audit boundary below.

Audit Boundaries

Claude explains information. Claude never changes settings or deletes chats.

Claude never contacts household members. Claude never receives the family list.

You make every account choice. You perform every deletion.

Your setup is ready. Next, you will ask the household for consent before building the Settings Record.

Plan the Privacy Audit

A shared household account can hold work, school, family, and money conversations in one place. The people around the kitchen table need a clear choice before anything changes.

“Tonight I am checking our shared account. Tell me what you want kept or removed. I will ask before touching anything that may be yours.”

Only after that conversation do you open Claude. This step fixes the consent record, audit design, and official sources before any account setting changes.

In this step, get ready to:

Record household consent locally by role.
Design the audit diagram and 60-minute timeline.
Use Web search in a normal chat outside every Project to check five official explanations.

Record household consent by role

Consent is a clear, informed choice. The family list stays in the local lab folder so Claude never receives names or household details.

Gather everyone who is present around the kitchen table.
Read this sentence aloud: “Tonight I am checking our shared account. Tell me what you want kept or removed. I will ask before touching anything that may be yours.”
In a local text editor, create a new note inside the lab folder for the household consent log.
Add lines for Account owner, Partner, Younger household member, and Older household member.
Add a separate Under-18 line when applicable.
Record either consent or no consent on each line.
Mark every absent household member as having no consent.
Leave anything that may belong to an absent household member untouched.

That is a careful start. Your local log now shows who consented without placing anyone’s identity or private details in Claude.

Design the local audit

A fixed plan keeps the audit inside one hour. The only authored output is the Settings Record.

A Memory topic is one saved item under Topics. A clock is one stated retention period or limit.

A fixture is a fixed test using invented information. It gives you repeatable proof without exposing a real person or place.

In a local text editor, create a second note inside the lab folder for the audit design.
Write Settings Record as the output name.

You can now see the audit’s destination at the top of the local design.

Add these planned sections to the design: four-column settings table, family list by role, Memory topic count, seven clocks, fixture proof, export proof, chat counts, and a four-line habit.
Record the diagram exactly as House sentence -> role list -> pages -> switches -> topics -> clocks -> fixture -> export -> real chats -> record.

The diagram now gives every activity a fixed place in the audit. It also keeps the household conversation ahead of every account action.

Your 60-Minute Structure

Minutes 0-25: Build.
Minutes 25-35: Validate.
Minutes 35-50: Apply a real case.
Minutes 50-59: Output.
Minute 60: Write the hour and stop.

Copy the five timeline entries into the local audit design.
Check that the diagram ends with the record.

Your local design now contains the complete audit structure. The minute-60 stop keeps the exercise bounded.

Check five official explanations

Official pages anchor each privacy claim to a source you can inspect. Claude explains those pages without changing a setting or receiving the family list.

A normal chat outside every Project keeps this source check separate from the redacted record you create later. The sign-in screen handles your credentials separately from chat content.

Open Claude through the browser or app route you already use for Claude Max.
Complete any sign-in verification shown by your existing account.
Confirm that your Claude Max account is active.
Start a normal chat from the main chat area outside every Project.

Claude may show a visible Web search control. The newer experience performs searches from an explicit request without showing a toggle.

✔️ I See the Web Search Control

Select the + control.
Select Web search.
Confirm that Web search has a checkmark.

ⓧ I See No Web Search Toggle

The newer experience searches when the request calls for current sources.

Include Use web search in your source request.

Five Source Checks

Model improvement means eligible chats may support future model training. Use the page How do I change my model improvement privacy settings?.
Retention means how long information remains stored. Use the page How long do you store my data?.
Memory means saved topics used across later chats. Use the page Use Claude’s chat search and memory to build on previous context.
Incognito means a temporary chat outside history and Memory. Use the page Use incognito chats.
Export means a copy of conversation data and account data. Use the page Export your Claude data.

Before you send the source request, do you expect Claude to show visible evidence that it searched the web?

Ask Claude for the five short explanations above using only official Anthropic and Claude pages, with the page title, date, link, meaning, and one limit for each.

You’ll see a search indicator in the conversation. You’ll also see citations attached to the response.

No Search Evidence?

Start a fresh normal chat outside every Project.
Add Use web search to the request.
Ask for official Anthropic and Claude pages only if other domains appear.

If the evidence is still missing, help me verify this web search request.

Open every cited page yourself.
Confirm that each cited page belongs to Anthropic or Claude.
Compare each explanation with its opened page.
In a local text editor, create an Official Source Notes note inside the lab folder.
Record the title, date, link, meaning, and one limit for all five pages.

Your local source note now covers model improvement, retention, Memory, incognito chats, and data export. Each note points back to a page you personally opened.

Add Pages checked: September 16, 2026. to the local source note.

Before your final check, do you expect every source note to contain all five required fields?

Return to each cited official page.
Confirm that every local note includes its title, date, link, meaning, and one limit.
Confirm that no household names, consent details, or family information appear in the Claude chat.

You’ll find five complete official-source notes in the lab folder. The Claude chat shows search evidence without containing household information.

That is the groundwork complete. Your consent log, fixed plan, and official notes now anchor the audit before you inspect any settings.

Validate Settings and Memory

Your five official-source notes now give each privacy claim a page you opened yourself. Those notes provide the reference point for checking the shared account.

Direct observation establishes the current settings in Claude. A fixed fixture reveals whether deleting a chat also clears a separate Memory topic.

In this step, get ready to:

Set three account controls to the lower-data choices.
Count Memory topics.
Verify seven retention clocks before running the invented fixture.

Set the controls and map family items

Privacy by default starts with the lower-data setting. A setting reduces Data Privacy risk. It never removes risk.

Consent remains the decision rule for anything connected to another household member. Claude receives only the three choices you observe.

Switch back to the signed-in Claude account from earlier.
Select your account name.
Select Settings.
Select Privacy.
Set Help Improve our AI models to off.

You will see Help Improve our AI models in the off state. This is your direct evidence of the current choice.

Record the observed model-improvement choice in your local notes.
Add September 16, 2026 as the observation date.
Add the official model-improvement page to the entry.
Write one local reason for the choice.

Turning off the sensitive-topic control removes sensitive items already saved to Memory. Take this slowly because the shared account may hold context connected to other people.

Return to Settings.
Select Memory.
Set Include sensitive topics in memory to off.
Select Generate memory from chats.
Choose Pause memory.
Leave Reset memory unselected.

You will see the sensitive-topic control turned off. You will also see memory generation paused.

Why pause instead of reset?

Pause keeps existing Memory. It stops using Memory and making new memories.

Reset permanently deletes all memories. The audit requires the narrow pause choice.

Record the observed sensitive-topic choice in your local notes.
Write one local reason for the sensitive-topic choice.
Record the observed memory-generation choice in your local notes.
Copy this reason into your local notes: “Pause keeps existing Memory. It stops using Memory and making new memories. Reset permanently deletes all memories.”
Add September 16, 2026 to both Memory entries.
Add the official Memory page to both entries.

Return to the normal non-Project chat from earlier.
Tell Claude the three control choices you personally observed.
Ask for one source-backed limit for each choice.
Require official Anthropic or Claude pages.
Keep the family list outside Claude.

Claude can explain one documented limit for each choice. Your own observations remain the evidence of the account state.

What belongs in the local map?

Each household item gets a local row with five fields. The fields are role, subject, consent status, touched setting, and action.

The touched setting comes from the four controls used in this audit.

Help Improve our AI models.
Include sensitive topics in memory.
Generate memory from chats.
Search and reference chats.

Switch back to the local consent log from earlier.
Complete one local row for every household item using the five fields.
Add a separate under-18 row when applicable.
Leave a possible item untouched when its person is absent.
Keep the completed map outside Claude.

That completes the control record without exposing the family list. Every mapped item now has a local consent-based action.

Can't find one of the controls?

Confirm that you are using the same signed-in consumer account from earlier.
Compare the current screen with the official page you already opened.
Record the control as unavailable when it does not appear on your account.

Keep household details out of any support request. Help me check the Privacy and Memory controls without sharing household information.

Read the topics and check seven clocks

A Memory topic is one saved item under Topics. Counting those items gives the Settings Record a fixed observation from today.

A retention clock states a period or limit. The opened official page wins whenever Claude gives different wording.

Return to Settings.
Select Memory.
Read every item under Topics.
Count the listed topics.
Record the observed total in your local notes.

Your local record now contains the Memory topic count from this account. The topic names remain outside Claude.

Deleting a topic about another person can remove context they expected the account to retain. Their agreement determines whether that deletion happens.

Identify any topic that concerns another person.
Ask that person before deleting the topic.
Leave the topic in place when they do not agree.
Select each topic whose deletion received agreement.
Select Delete for that agreed topic.
Record the agreement behind each topic deletion locally.

The seven clocks cover kept chats, deleted chats, model-improvement data, flagged content, trust and safety scores, feedback data, and consumer incognito chats.

Return to the normal non-Project chat from earlier.
Ask Claude to explain the seven clocks in plain words.
Require official Anthropic or Claude sources.
Check each answer against the named page you already opened.
Record the opened page's wording whenever Claude differs.
Leave legal conclusions out of the record.

What should the seven clocks say?

Kept chats have no fixed stated period.
Deleted chats disappear from history immediately. Back-end deletion occurs within 30 days.
Eligible model-improvement data may remain for up to five years.
Flagged inputs and outputs may remain for up to two years.
Trust and safety scores may remain for up to seven years.
Feedback data lasts five years.
Consumer incognito chats last 30 days.

You now have a checked topic count plus seven source-backed clocks. The local record separates direct account observations from Claude's explanations.

Run the invented fixture

The fixture uses an invented pet plus an invented town to test past-chat search without exposing household information. It follows the deletion path from a source chat to a separate Memory topic.

Return to Settings.
Select Memory.
Record the starting state of Search and reference chats locally.
Temporarily enable Generate memory from chats.
Set Search and reference chats to on for the fixture.

You will see memory generation active for the fixture. You will also see past-chat search turned on.

Choose a made-up pet name.
Choose a made-up town.
Confirm that neither choice matches a real person, pet, company, school, bank, or place.
Start a fresh normal chat outside every Project.
Send one invented pet-and-town fact using the words “remember this”.

Return to Settings.
Select Memory.
Confirm that the invented pet appears under Topics.

You will see a Memory topic for the invented pet. This proves that the fixture created a separate saved item.

Pet topic missing?

Return to the fixture chat.
Send the made-up fact again using the words “remember this”.
Check Topics again.
Keep the fixture in place instead of replacing it with a settings check.

Use only invented information during the retry. Help me diagnose why an invented fixture did not create a Memory topic.

Before this search, consider whether the source chat will be found.

Start another fresh normal chat outside every Project.
Ask Claude to find the chat containing the invented pet fact.
Confirm that a past-chat search tool call appears.
Confirm that the original fixture chat is found.
Record the Search 1 result locally.
Record the Search 1 time locally.

Search 1 finds the original fixture chat. The visible tool call proves that Claude used past-chat search.

Deleting the source chat removes it from history. This fixture contains invented information, so the deletion does not touch household material.

Use the original fixture chat's menu to delete that chat.
Start another fresh normal chat outside every Project.

Before this check, consider whether deleting the chat also removed the saved pet fact.

Ask Claude to search for the deleted pet chat.
Ask Claude what it knows about the invented pet.
Confirm that a past-chat search tool call appears.
Record the Search 2 result locally.
Record the Search 2 time locally.

Search 2 shows that the deleted chat is absent. Claude may still know the pet fact through the separate Memory topic.

Why is this the planned failure?

Deleting a conversation does not automatically remove a related Memory entry. The surviving pet fact proves that chat history and Memory topics require separate checks.

The repair now targets only the invented fixture topic. This narrow deletion protects every real household topic.

Return to Settings.
Select Memory.
Select only the invented pet topic.
Select Delete.
Start one final normal chat outside every Project.

Before this final check, consider whether Claude can still name the invented town.

Ask what town the invented pet came from.
Tell Claude not to guess.
Record the final result locally.
Record the final check time locally.

You should receive an answer reporting that nothing is known about the town. That final unknown result confirms that the invented Memory topic is gone.

Return to Settings.
Select Memory.
Select Generate memory from chats.
Choose Pause memory.
Restore Search and reference chats to the starting state you recorded.

The temporary fixture settings are now restored. Only the invented pet topic was deleted during the test.

Before the final comparison, consider whether every required control and proof item is present.

Return to Privacy.
Confirm that Help Improve our AI models remains off.
Return to Memory.
Confirm that Include sensitive topics in memory remains off.
Confirm that Generate memory from chats shows Pause memory.
Confirm that Search and reference chats matches its recorded starting state.

Count the seven clock entries in your local notes.
Confirm that Search 1 has a result plus a time.
Confirm that Search 2 has a result plus a time.
Confirm that the final unknown result has a time.

Your record now shows three observed choices, seven clocks, two timed searches, and the timed final unknown result. The planned deletion failure has been repaired using invented information.

Your settings and Memory evidence now match the audit design. Next, you will draft the Settings Record before applying the consent rules to real chats.

Review Chats and Request Export

Your fixture proved that deleting a chat can leave its Memory topic behind. You removed only the invented topic before restoring the recorded controls.

Anthropic announced its consumer model-improvement choice on August 28, 2025. Existing users had until October 8, 2025 to make that choice.

The announced retention period for new or resumed chats was five years. Today’s observed switch shows whether that earlier choice remains current.

This step turns your observations into a local Settings Record. You will request an export before reviewing real chats under household consent.

In this step, get ready to:

Create a local Settings Record with the required table plus monthly habit.
Request the account export while keeping it outside every Project.
Review real chats directly under the consent rules before the stopping limit.

Draft the local Settings Record

Claude can draft the blank structure without receiving family information. The private family list stays local.

Switch back to a normal chat outside every Claude Project.
Ask Claude to draft a blank Settings Record without household information.
Require exactly four columns in this order: Setting, What I chose, Date, Page.
Require blank space directly below the table for the family list by role.
Require the four-line monthly habit exactly as written below:

On each month’s first day, request an export. Save it when it arrives.
That day, delete chats holding real messages. Ask first when one might belong to someone else.
Read Memory topics. Ask before deleting one about another person.
Write the date, counts, and next month’s date in this record.

Require October 1, 2026 as the next review date.
Check that Claude’s draft contains no household information.
Save Claude’s blank draft as a local document named Settings Record inside the lab folder from earlier using your usual document editor.
Confirm Settings Record appears inside the local lab folder.

Your local document now has the required structure. The family section remains blank until you fill it locally.

Add a row named Help Improve our AI models.
Add a row named Include sensitive topics in memory.
Add a row named Generate memory from chats.
Enter off in the What I chose column for Help Improve our AI models.
Enter off in the What I chose column for Include sensitive topics in memory.
Enter Pause memory in the What I chose column for Generate memory from chats.
Enter September 16, 2026 in the Date column for all three rows.

Why fill the rows yourself?

The table records choices you personally observed. Claude explains the controls without choosing their states.

Each setting reduces privacy risk. No setting removes that risk completely.

Link the first row to How do I change my model improvement privacy settings? in the Page column.
Link the second row to Use Claude’s chat search and memory to build on previous context in the Page column.
Link the third row to Use Claude’s chat search and memory to build on previous context in the Page column.
Save Settings Record.
Confirm the table has exactly four columns.
Confirm the blank family-list space sits directly below the table.
Confirm the monthly habit contains exactly four lines.
Confirm the next review date is October 1, 2026.

Good work. Your working record now separates the public setting evidence from the private family material.

Request the account export

An export contains conversation data plus account user data. It stays outside every Claude Project.

This file can contain private household material, so keeping it in the local lab folder protects the boundary you established.

Switch back to Claude.
Select your account name.
Select Settings.
Select Privacy.
Select Export data.
Switch back to the local Settings Record.
Record the export request time: your export request time.

Claude processes the request before sending a link to the account email. The export page promises no delivery time.

Your next move depends on whether the delivery email has arrived.

✔️ The export link arrived

The delivered link expires 24 hours after delivery. Use it while you remain signed in.

Open the delivered export link while signed in to Claude.
Save the export inside the local lab folder.
Confirm the saved export appears inside the lab folder.
Keep the export outside every Claude Project.
Record the locally saved status in Settings Record.

ⓧ The export is still pending

The export page gives no promised delivery time. The link expires 24 hours after it eventually arrives.

Write Export pending in Settings Record.
Return to the Privacy page later to follow up on the request.
Keep any chat you want preserved until the export arrives.
Copy urgently needed text into the local lab folder before deleting its chat.
Keep the export outside every Claude Project when it arrives.

Can’t find the export request?

Confirm that you selected Privacy from Settings on the signed-in individual account.

Use the official Export your Claude data guide for the current path. Help me locate the export option without exposing my account data.

Your export request now has a recorded time. Its local-only destination is also clear.

Review the real chats

The real review applies your privacy choices to chats that may belong to different people. Likely ownership comes from your knowledge of each subject.

Deletion deserves a pause because a saved export or local copy protects text you mean to keep.

Check the audit timer from your four-part plan.
Review chats from the last 30 days.
Stop when the review reaches 20 chats.
Stop at minute 50.

The first limit you reach ends the review. Stopping on time preserves the final ten minutes for your proof.

Judge each chat’s likely owner from its subject plus your personal knowledge.
Keep Claude out of the real-chat review.
Ask yourself whether you would read your own chat aloud to Pineapple Advisory.
Delete your own chat when your answer is no.
Keep your own chat when your answer is yes.

Your own chats now follow one consistent test. Chats that may belong to someone else follow the household consent log.

An absent person remains a no-consent case. Their possible chats stay untouched.

Ask the likely owner before deleting their chat.
Leave the chat untouched when consent is absent.
Record the no-consent decision by role in the local family-item map.
Ask the owner to copy wanted text into the local lab folder.
Follow their keep-or-delete choice after the copy is safe.
Record the final action by role in the local family-item map.

Before you total the review, which count do you expect to be largest?

Switch back to the local Settings Record.
Record the stop time: your minute-50 stop time.
Record the chats reviewed: number of chats reviewed.
Record your chats deleted: number of your chats deleted.
Record your chats kept: number of your chats kept.
Record other chats deleted after consent: number of other chats deleted after consent.
Record other chats kept by request: number of other chats kept by request.
Record other chats left without consent: number of other chats left without consent.

Add the six outcome counts in your local record.
Compare the total with number of chats reviewed.
Confirm every other-person deletion has consent recorded by role.
Confirm every requested text copy stays inside the local lab folder.

You should see the six outcome counts match the total number of chats reviewed. Your record also shows the exact stopping time.

Frame only the stop time plus six aggregate counts in your screenshot.
Keep chat titles plus household details outside the screenshot.

That is the sensitive part complete: you reviewed real chats without handing them to Claude.

Your working Settings Record now captures the observed switches plus the export status. Next, you will finish its proof section before creating the redacted Project copy.

Finalize the Settings Record

Your minute-50 review turned the privacy settings into decisions about real household chats.

The finished Settings Record must prove every choice. It must also prove every deletion.

It must capture each consent decision. Every count or pending item must remain visible.

The complete record stays local with any account export. A redacted copy enters your Claude Project.

In this step, get ready to:

Check every required item in the complete local record.
Create a redacted Project copy with private household material removed.
Add the final boundaries before the minute-60 stop.

Check the complete local record

A complete record connects each observed setting to its evidence. The local copy also preserves the household decisions that must stay outside Claude.

Return to the local lab folder from earlier.
Open the working Settings Record.
Check that the table has exactly four columns named Setting, What I chose, Date, and Page.
Confirm that the Help Improve our AI models row records off.
Confirm that the Include sensitive topics in memory row records off.
Confirm that the Generate memory from chats row records Pause memory.
Check that each setting row includes your observed choice.
Check that each setting row includes its date and official page.

You should see exactly three completed rows. Each row should point back to the page that supports the recorded choice.

Check that the five official source notes include each page title.
Check that every source note includes its date and link.
Check that every source note includes its meaning and one limit.
Confirm that the source section includes Pages checked: September 16, 2026.
Check that each family-list line includes its role, subject, consent, touched setting, and action.
Confirm that absent people are recorded with no consent.
Confirm that possible items belonging to absent people remained untouched.
Check for a separate Under-18 line when applicable.

The family section should show decisions by role without sending any household information to Claude.

Check that the record includes the observed total number of Memory Topics.
Check that every recorded topic deletion had the affected person's agreement.
Check that all seven retention clocks match the descriptions below.

Seven clocks to match

Kept chats have no fixed stated period.
Deleted-chat history removal is immediate. Back-end deletion occurs within 30 days.
Eligible model-improvement data may remain for up to five years.
Flagged inputs and outputs may remain for up to two years.
Trust and safety scores may remain for up to seven years.
Feedback data lasts five years.
Consumer incognito chats last 30 days.

Check that Search and reference chats has its observed starting state recorded.
Check that the fixture state records temporary Memory generation.
Check that the fixture state records past-chat search as on.
Check that the final state records Pause memory.
Check that the final past-chat search state matches its observed starting state.
Confirm that Search 1 includes its result and time.
Confirm that Search 2 includes its result and time.
Confirm that the final unknown result includes its time.

Search 1 should show that the original invented chat was found. Search 2 should show that the deleted chat was absent while the separate Memory topic could still preserve the invented fact.

Check that the export proof includes its request time.
Confirm that its status records a local save or Export pending.
Check that the minute-50 proof includes the stop time.
Confirm that it includes the number of chats reviewed.
Confirm that it includes your deleted-chat count.
Confirm that it includes your kept-chat count.
Confirm that it includes all three other-person chat counts.

Four-line habit to match

1. On each month’s first day, request an export. Save it when it arrives.
2. That day, delete chats holding real messages. Ask first when one might belong to someone else.
3. Read Memory topics. Ask before deleting one about another person.
4. Write the date, counts, and next month’s date in this record.

Compare the four-line habit in your Settings Record with the version above.
Check that the next review date appears directly with the habit.

Create and inspect the redacted copy

Redaction removes the family list and every household detail. The remaining evidence can show the audit process without exposing who made each decision.

What belongs in the Project copy?

The Project copy keeps the settings, official pages, seven clocks, Memory topic count, proof times, aggregate counts, habit, next review date, phone observation, and pending items.

It excludes the family list, household details, consent notes, copied household text, and the export.

Create one separate local copy of the Settings Record inside the lab folder by using your document app's copy option.
Remove the complete family list from the redacted copy.
Remove every remaining household detail from the redacted copy.
Remove all role-level consent details from the redacted copy.
Retain the three setting rows and their official pages.
Retain the seven clocks and Memory topic count.
Retain the proof times and aggregate chat counts.
Retain the habit, next review date, and pending items.

Your phone entry records only what you observe. Choose the path that matches how you use Claude.

I use Claude on a phone

The phone comparison checks the same three displayed choices once. It does not assume that a setting synchronized instantly.

Use the Claude phone app you already use to compare Help Improve our AI models.
Compare Include sensitive topics in memory.
Compare Generate memory from chats.
Record exactly what you observe in the complete local Settings Record.
Copy the same phone observation into the redacted Settings Record.

I do not use Claude on a phone

A direct note closes the phone check without claiming that a comparison occurred.

Write No phone app. in the complete local Settings Record.
Write No phone app. in the redacted Settings Record.

Uploading a privacy record can feel risky, so this copy is deliberately stripped of household details before it reaches the Project.

Return to the lab Project from earlier.
Place the redacted Settings Record in the Project.
Open the Project copy.
Confirm that the family list is absent.
Confirm that every household detail is absent.
Confirm that the account export is absent.

That is the sensitive split completed. Your full evidence remains local while the Project contains only the audit summary.

Found private material in the Project copy?

Remove the Project copy before continuing.
Return to the local redacted copy.
Delete the family list and any remaining household details.
Place the corrected redacted copy in the Project.

If you are unsure whether a detail identifies someone, leave it out. Help me check whether this record is safely redacted.

Add the boundaries and stop

The final boundaries keep the Data Privacy claim honest. A setting reduces risk.

It never removes risk. The record must say what Claude can still retain or do.

Boundary text to include

This does not make family chats private.
Flagged chats may still support internal trust and safety work.
Turning training off cannot undo active or completed training.
One shared account does not create separate household access.
Memory outside Projects still belongs to that account.
Claude explains information.
Claude never sets switches or deletes chats.
Claude never sees the family list or contacts anyone.
Claude never sends, signs, files, or pays.
You make every choice and every deletion.
The export service sends only the requested link.
Nothing else is uploaded or sent.
The complete record stays in the lab.
Only the redacted Settings Record enters the Project.

Add every boundary statement above to the complete local Settings Record.
Add the same boundary section to the local redacted Settings Record.
Replace the earlier redacted Project copy with the updated redacted copy.
Confirm that the proof-you-keep section names the complete local record.
Confirm that the proof-you-keep section names the redacted Project copy.
Confirm that the proof-you-keep section names the local export when it has arrived.
Keep Export pending visible when the export has not arrived.

Before the final check, do you expect both copies to contain the same public evidence?

Open the complete Settings Record in the local lab folder.
Switch back to the updated redacted Settings Record in the lab Project.
Position the two records so you can compare their sections.

You can now test whether the local copy is complete while the Project copy remains redacted.

Read all three setting rows aloud from the local record.
Read the local family list aloud against its required fields.
Read the separate Under-18 line when applicable.
Read the Memory topic count and seven clocks aloud.
Read the three Search and reference chats states aloud.
Read the fixture results and their proof times aloud.
Read the export proof and minute-50 chat counts aloud.
Read the habit, next review date, phone entry, boundaries, and pending items aloud.

The local copy should now contain every required setting, consent decision, clock, fixture result, export item, chat count, habit line, and boundary.

Check that the Project copy retains the settings, pages, clocks, topic count, proof times, aggregate counts, habit, next review date, phone entry, boundaries, and pending items.
Confirm that all household material is absent from the Project copy.
Confirm that the export is absent from the Project.

You should find complete evidence in the local record. You should find only redacted evidence in the Project record.

At minute 60, write the hour in the notebook entry.
Stop the audit.

You have completed the kitchen-table privacy audit. The full record and any export remain in the lab while the Project holds only the checked redacted copy.

Secret mission

Run a Least-Disclosure Review

Stress-test the redacted Settings Record line by line. You will remove any unnecessary household detail while preserving the proof that makes the audit useful.

Clean Up Your Resources

The audit adds no ongoing cost because it uses your local lab folder plus your existing Claude Max plan. Decide whether to keep the evidence, pause until the next review date, or remove it.

Resources you used:

Local evidence: The local lab folder containing the complete Settings Record plus every local-only artifact.
Project evidence: The redacted Settings Record stored in the lab Claude Project.

Keep everything running

No action is needed while you plan to use the audit evidence. Keeping both copies supports the next review date recorded in your Settings Record.

Keep the local lab folder so the complete Settings Record remains available for your next review.
Keep the redacted Settings Record in the lab Claude Project for the same review.
Check the account email if the Settings Record says Export pending.
Open the export delivery link while signed in to Claude within 24 hours after delivery.
Save the export inside the local lab folder when it arrives.

Pause - I'll come back to this later

Pausing closes the audit for now. There are no running processes to stop.

Leave the local lab folder unchanged.
Leave the redacted Settings Record in the lab Claude Project.
Check the account email if the Settings Record says Export pending.
Open the export delivery link while signed in to Claude within 24 hours after delivery.
Save the export inside the local lab folder when it arrives.
Return to the audit on the next review date written in the Settings Record.

Delete - I don't want to use this again

Deleting the audit evidence is permanent. Your files stay safe until you complete the delete steps below.

Remove the Project copy:

Return to the lab Claude Project from earlier.
Locate the redacted Settings Record in the Project file list.
Open the options menu for that file.
Select the option that removes the file from the Project.
Confirm the redacted Settings Record no longer appears in the Project file list.

Remove the local lab folder on your laptop:

macOS

Locate the local lab folder in Finder.
Move the local lab folder to the Trash.
Empty the Trash.
Confirm the local lab folder no longer appears in Finder.

Windows

Locate the local lab folder in File Explorer.
Move the local lab folder to the Recycle Bin.
Empty the Recycle Bin.
Confirm the local lab folder no longer appears in File Explorer.

Linux

Locate the local lab folder in your file manager.
Move the local lab folder to the deleted-items location.
Empty the deleted-items location.
Confirm the local lab folder no longer appears in your file manager.

Leave any later export delivery link unused if the deleted Settings Record said Export pending.

The unused export link expires 24 hours after delivery. The Claude account plus its plan remain unchanged.

Nice Work!

You did it! Your household privacy audit now has a complete local Settings Record plus a redacted copy in your Claude Project.

You've learned how to:

Protect household information by recording consent by role only in the local lab folder.
Prove a deletion boundary with two timed searches plus one invented Memory fixture.
Complete a timed real-chat review with aggregate counts in the complete local Settings Record.
Secret Mission: Complete the optional challenge to push your privacy-audit skills further.

Ready to quiz yourself?