# Claude shared chats in Google: how to revoke your links
> On July 25, public Claude chats and artifacts appeared in Google results. A guide to checking your links, revoking them, and removing outdated search results.
Source: https://ailoot.ai/blog/en/claude-shared-chats-search-privacy/
Canonical: https://ailoot.ai/blog/en/claude-shared-chats-search-privacy/
Language: en
Publisher: Ailoot (https://ailoot.ai/)
Translation: guide-023
Revision: sha256-fba2493f37a97b8a7b9dd862cf5ad36565c89a31cd6b9bdd45ebbb40dff77d8e
Key takeaway
On Saturday, July 25, pages containing shared Claude chats—the ones you had made accessible by link—were found showing up in Google results. They included medical reports, work documents marked “for internal use,” and access keys. By Monday evening, the chats had been removed from search results; artifacts remained longer. Your links, meanwhile, were still live: search indexing and public access operate independently.
Ailoot reference documentation: [ailoot.ai/docs/](https://ailoot.ai/docs/).
## What happened to shared Claude chats on July 25?
Key takeaway
On Saturday evening, other people’s shared Claude chats were found in Google results. A day later, Google began removing the results; by Monday, the chats were gone from search results, while artifacts remained longer. Anthropic said that the links were designed to work that way; it did not acknowledge an error.
It all unfolded over three days, and by Monday the cleanup of search results was already underway.
Who this affects. If you have ever clicked Share in Claude or published an artifact, you have a page on the internet, and you probably don’t remember it. You can revoke it after the fact, and below I show how to do that in five minutes.
Nobody has a single figure for “how much leaked in total,” and I won’t pretend to know more precisely.
There is not a word about it on Anthropic’s website.
The links are public by design, and they appeared in search because someone posted them elsewhere and a crawler found them through an external link. Formally, that is all true. But someone who clicked Share to show one conversation to a colleague rarely keeps in mind that they have created a page on the internet.
## What exactly appeared in search?
Key takeaway
The results included working documents belonging to real people: medical records with names, corporate files marked confidential, and correspondence containing children’s contact details. A separate category was access keys: researchers found tokens for cloud services and crypto wallets in indexed material. For businesses, these are the most costly items on the list because a key works immediately and without a password.
Reported examples include a real patient’s medical report, clinical trial results with names, and documents containing the names and phone numbers of elementary school children. Further down the list were corporate files marked “for internal use only” and employee reviews with personal information.
The list also included crypto wallet keys, names and addresses, work notes, and programming conversations.
AWS Access Key IDs and a Replicate access token were found among the indexed material—in other words, keys to someone else’s infrastructure.
Ordinary work routines are what cost businesses the most. A contract sent to Claude for proofreading carries its amounts and supplier terms with it. An export from a customer spreadsheet carries names and phone numbers with it. A configuration file pasted in full carries keys with it. None of this seems secret at the moment it is sent; it becomes secret precisely when the page appears in search results.
A key in the open can turn into someone else’s cloud bill on your card. A similar case was covered in the guide [“How Someone Else’s Repository Hacks Claude Code”](https://ailoot.ai/blog/en/malicious-repository-claude-code/): it began with someone else’s repository and ended the same way.
## Why is a link “just for our people” a page on the internet?
Key takeaway
The Share button in Claude takes a snapshot of a conversation and puts it at a permanent address beginning with claude.ai/share followed by a long string of characters. The page opens without signing in. The address cannot be guessed, but the protection rests entirely on nobody seeing it. One post in a chat or on a forum makes the address available to a search crawler.
Anthropic’s official help documentation describes the mechanics directly: anyone with the link can see a snapshot of the chat, including all messages up to the moment it was shared and all artifacts inside it.
Anyone with the link can view a snapshot of the chat. The snapshot includes all messages sent up to the moment it was shared, including any artifacts.
— Claude Help, section on sharing chats, https://support.claude.com/en/articles/10593882-share-and-unshare-chats
Four details about this snapshot:
1. The page shows a snapshot of the conversation as it was when you clicked the button. Messages written after sharing are not included.
2. The snapshot is updated only if you share it again: revoke the link, share it again, and it will include everything new.
3. Attached files are not included in the snapshot, but Claude’s answer about the file is included in full. The contract itself won’t leak; its summary will.
4. Public links are not available on Team and Enterprise plans at all: sharing is limited to people in your organization.
The last point explains why the incident mainly affected people who pay for Claude themselves. If you have a team and work with customer data, a business plan closes this gap completely: there simply is no public link.
It is also worth distinguishing two mechanisms that are constantly confused. **Share** opens access to the entire conversation: the correspondence, your prompts, Claude’s answers, and any artifacts inside. **Publish** publishes one artifact on a separate page, and the conversation is not visible through that link. You need to check both lists: they are in different places in the interface, and closing one does not close the other. An artifact has a third surface too: the **Get embed code** button. It provides ready-to-use code for placing the artifact on a third-party website, with a list of permitted domains. If you have ever used this, a copy of your artifact may also live on someone else’s page, and unpublishing it in Claude will not remove it from there.
The help documentation does not say what happens to a link if you delete the conversation itself. Anthropic says nothing about this, and I won’t fill in the gaps for it. The practical conclusion is simple: don’t assume deleting a chat closes the public page. Revoke the link first, then delete anything you want.
Want what goes out to stop being a matter of chance? That is decided before the first prompt, by what you put into the model’s context in the first place. It’s called context engineering.
## What did Anthropic fix, and what stayed the same?
Key takeaway
Google’s results were cleaned up within a couple of days; Anthropic did not say how. The pages’ technical configuration remained the same and, at the time this guide was published, still does not protect them from indexing. The analysis shows two requests to the server: the path for shared chats is blocked in a way that prevents a search crawler from seeing the no-index instruction.
The first check requires no terminal at all: open `claude.ai/robots.txt` in your browser. This file contains rules for search crawlers and is publicly available on every website. You can do the same thing in a terminal:
```bash
curl -s https://claude.ai/robots.txt
```
Among other things, the response contains the line `Disallow: /share/*` in the section for all crawlers. The browser will not show the second item you need to check: page headers are visible only in a request. If you don’t want to use the terminal, ask Claude Code to show the response headers for `claude.ai/share/` followed by any string of characters; it will run the command and show them.
```bash
curl -sI https://claude.ai/share/ANY-STRING-OF-CHARACTERS
```
The response contains `HTTP/2 200` (the page was served normally) and the header `x-robots-tag: none`, which means “do not index.”
At the same time, `Disallow` tells the crawler not to visit the page at all. A crawler that is not allowed to visit cannot read the header that says not to index it. Under its rules, Google may put an address found through an external link in its index without opening the page at all.
Both requests check the server configuration and reveal nothing about other people’s data: in the second one, the address is replaced with a string of characters that is deliberately nonexistent, and the page returns the same status code as it does for a real chat. Trying addresses one by one is pointless and risky—which is why you should check your own links through the list in settings, where they are already shown.
Published artifacts are configured differently, and more correctly. Their path is not blocked in the rules file, so the crawler visits the page, sees the no-index instruction in its code, and follows it. In other words, one product has two different setups, and the one that holds conversations is not protected from indexing by this mechanism.
The line `Disallow: /share/*` was already in Claude’s rules file in September 2025, so the rule did not change between the two similar incidents and is still in place.
Attention
Cleaning up search results does not revoke links. The page has disappeared from Google, but anyone who saved its direct address can still open it. Only you can revoke it, and only by doing it yourself.
## How to check your shared chats in five minutes
Key takeaway
Claude does not have a short, separate “my public links” page. The list opens in a separate window from the privacy settings. The step-by-step instructions below use the English menu labels. There is also a second way to check through the conversation itself if the list does not open for some reason.
In the example described, the list included links that had been forgotten within a week of being created: a couple of work conversations and one analysis prepared for a colleague.
1. ### Open the privacy settings
Direct address: `claude.ai/settings/data-privacy-controls`. Another way is to click your initials in the lower-left corner, then **Settings**.
2. ### Go to the Privacy tab
The Privacy tab is the privacy section. Scroll through it all: the relevant block appears at different points in different interface versions, sometimes inside **Your Data**.
3. ### Find Shared chats and click Manage
A window will open with a list showing the chat title, publication date, and link.
4. ### Click Unshare next to each line you no longer need
Revoke links one at a time. Copy the addresses into a text file while you’re there; you will need them when checking search results.
5. ### Check the result in an incognito window
Open a new incognito window (Cmd+Shift+N or Ctrl+Shift+N) and paste the revoked address. In a regular window, you are already signed in and will see your chat regardless, so that check proves nothing.
The second method works for one specific conversation. Open the chat, click **Share** in the top right, and change **Shared** to **Private** in the visibility list. After that, the direct link will stop working.
Note
The official help describes the path as Settings → Privacy → Shared chats → Manage. Independent analyses describe a longer path through the Your Data block and a trash icon. The difference is most likely due to different interface versions. Open the Privacy tab and scroll to the bottom; you will find the block in any version.
## Where to find published artifacts
Key takeaway
Artifacts are the other half of the problem, and they are the part people miss most often. A published artifact has its own address, separate from the conversation, and it appeared in search alongside the chats. The list is in the Artifacts section of the sidebar. Unpublishing is irreversible: you will not be able to publish that same artifact again.
An artifact is something Claude builds right in the conversation window: a mini-app, document, or dashboard. When you click **Publish**, it gets a permanent address beginning with `claude.ai/public/artifacts/` followed by a string of characters. Anyone can open it, even without an account: the help documentation puts it plainly—“view and use any published artifact without signing up.”
Next, do three things, all in the Claude interface:
1. Open `claude.ai/artifacts`—this is the list of published items.
2. Also check the Privacy tab in settings: in some interface versions there is a separate Shared artifacts line with its own Manage button.
3. Open any artifact you no longer need and click **Unpublish**.
The help documentation warns about two things:
Once an artifact is unpublished, that same artifact cannot be republished. If the artifact used persistent storage, unpublishing it also permanently deletes all associated data, both private and shared.
— Claude Help, section on publishing artifacts, https://support.claude.com/en/articles/9547008-publish-and-share-artifacts
So if your artifact was a mini-app that accumulated data, that data will disappear along with the publication. Export it first, then unpublish it.
There is also a discrepancy in the interface itself. The artifact publishing window warns that artifacts may be visible in search engines. Shared chats have no such warning—the same flawed logic as in the page settings.
## I revoked the link, but the page is still in search. What should I do?
Key takeaway
Revoke access first, then submit a removal request: Google’s tools work only for pages that are already gone. The fast tool in Search Console, Google’s service for site owners, is unavailable to you because the domain belongs to Anthropic. Two free Google forms for other people’s sites remain. Bing and Yandex have their own tools; Yandex’s should work because Claude pages are blocked in robots.txt, which is one of its requirements.
Google’s cache is gone. “Cached” links were removed in early 2024, and the `cache:` operator was fully disabled by September 2024. Now the search result itself is what gets removed.
| Tool | Address | Works for someone else’s site | Requirement |
|----|----|----|----|
| Search Console Removals | `search.google.com/search-console` | No, only for your own domain | Unavailable; claude.ai belongs to Anthropic |
| Refresh Outdated Content | `search.google.com/search-console/remove-outdated-content` | Yes | The page must already have been deleted or changed |
| Remove personal information | `support.google.com/websearch/contact/content_removal_form` | Yes | Covers phone numbers, addresses, email addresses, account and card numbers, usernames, and passwords |
| Bing Content Removal | `bing.com/webmasters/tools/contentremoval` | Yes, you do not need to verify site ownership | For an outdated copy, provide a word that was in the old copy but has disappeared from the page |
| Yandex Webmaster | `webmaster.yandex.ru/tools/del-url/` | Yes, for unverified sites | The page must be blocked in robots.txt, return 404/403/410, or contain meta noindex |
The order matters: a request about a live page will not go through.
1. Revoke the link in Claude and check in an incognito window that it no longer opens.
2. Submit a request through Refresh Outdated Content, using the dead address.
3. If the conversation contained your personal information, account details, or passwords, also submit the personal information removal form. It is more reliable: it works for other domains and covers exactly these categories.
4. Use Bing’s own form for Bing.
5. Yandex accepts a request at `webmaster.yandex.ru/tools/del-url/` even without verified site ownership. The condition is that the page is blocked in robots.txt, returns 404, 403, or 410, or contains meta noindex. The first condition is met for Claude shared chats, which is the rare case where the flawed setup works in your favor.
Attention
A caveat about automatic checks. A shared chat page returns status code 200 even for a nonexistent address: “chat not found” is rendered in the browser. Because of this, Google’s automation may not recognize the page as deleted and may reject your request. It is still worth submitting; just keep in mind that this one route will not settle the issue.
Google does not publish processing times for requests, and I won’t supply a number that is not in the documentation. Its help documentation says requests for your own domain take about a day, but that path does not apply to our case.
## Why is this the sixth such incident in three years?
Key takeaway
Bard in 2023, ChatGPT and Grok in 2025, Meta’s chatbot that same year, Claude in September 2025, and Claude again in July 2026. Five companies, six incidents, the same fork in the road every time: a “share” button moves a conversation into public access, and the user learns about it from the news. Meta’s chats also appeared in the app’s public feed.
The previous incident was Anthropic’s own, ten months earlier. In September 2025, the number of indexed Claude conversations was estimated at “just under 600.” They included prompts from the Anthropic team itself and work tasks containing employees’ names and email addresses.
The configuration of shared chat pages did not change between these two incidents: the line `Disallow: /share/*` was already present in September 2025.
The mechanics have repeated across the other products too; only the scale changes:
| Product | When | Scale | What happened |
|----|----|----|----|
| Google Bard | September 2023 | More than 300 pages | Google called the indexing unintended and began removing results |
| ChatGPT | July 2025 | Almost 4,500 conversations | OpenAI removed the “make chat findable” checkbox entirely |
| Grok | August 2025 | More than 370,000 transcripts | The largest incident; users were not warned in advance |
| Meta chatbot | Summer 2025 | No estimate | Chats were published in the public Discover feed |
| Claude | September 2025 | About 600 conversations | Results disappeared from search the next business day |
| Claude | July 2026 | No single estimate | Search results were cleaned up on July 26–27 |
After six such incidents, there is no point in expecting your link to remain unnoticed. Plan as if any link you create will eventually appear in search.
## What should you never send to an AI chat?
Key takeaway
The UK’s cybersecurity center puts it this way: don’t submit a prompt whose publication would cause you problems. Anthropic’s own help documentation names four categories. The international OWASP reference adds a fifth and sixth.
Anthropic [advises against sending](https://privacy.claude.com/en/articles/8325621-i-would-like-to-input-sensitive-data-into-my-chats-with-claude-who-can-view-my-conversations) financial information, medical records, passwords and private credentials, and confidential business and personal documents. The wording is gentle—“we recommend that you exercise care”—but the list is specific.
The OWASP international security reference used by security teams [goes further](https://genai.owasp.org/llmrisk/llm022025-sensitive-information-disclosure/): personal information, financial information, medical records, confidential business materials, credentials, and legal documents. It also cautions that built-in model restrictions “are not always followed and can be bypassed.”
You should not send prompts to public language models if their publication would cause you problems.
— UK National Cyber Security Centre, https://www.ncsc.gov.uk/blog-post/chatgpt-and-large-language-models-whats-the-risk
Five categories that should never go into a Claude conversation:
1. **Personal information about customers and employees.** Names, phone numbers, email addresses, home addresses, passport details. Uploading a customer database to a chat means transferring data to a third party, with all that entails.
2. **Account and payment details.** A common example is sending a complete bank statement so Claude can put it into a table.
3. **Keys and tokens.** In this incident, an AWS key and a Replicate token were exposed. A typical scenario is pasting an entire configuration file so Claude can help troubleshoot it.
4. **Contracts and trade secrets.** A supplier contract sent for review carries its amounts and terms with it.
5. **Medical and personnel data.**
Anonymization addresses the issue more effectively than a prohibition. Before giving Claude an export, you can replace “Customer Ivan Ivanov, phone number such-and-such, account such-and-such” with “customer A.” Claude will solve the task just as well using placeholders, and the page in search will be meaningless. For more on where the boundary of trust in a tool lies, see the separate guide [“Is It Safe to Give Claude Code Access to Your Data?”](https://ailoot.ai/blog/en/claude-code-data-access-safety/).
## Are your conversations used to train the model?
Key takeaway
On Free, Pro, and Max plans, this is controlled by a switch in the privacy settings. Conversations are never used for training on business plans or through the API. The retention period depends on the same switch: 30 days when training is off, and up to five years when it is on. A deleted conversation is never used for training, regardless of your settings.
Anthropic laid this out by plan in its [updated consumer terms](https://www.anthropic.com/news/updates-to-our-consumer-terms), and the difference is stark:
| Plan | Are conversations used to train the model? |
|----|----|
| Free, Pro, Max (including Claude Code on these accounts) | At the user’s choice; the switch is in Settings → Privacy |
| Claude for Work (Team, Enterprise) | No |
| Claude for Government, Claude for Education | No |
| API, including through Amazon Bedrock and Google Cloud | No |
Retention periods are [described in separate help documentation](https://privacy.claude.com/en/articles/10023548-how-long-do-you-store-my-data):
1. A conversation you delete disappears from your history instantly and is erased from Anthropic’s servers within 30 days.
2. The standard retention period is 30 days; if training is enabled, it is up to five years in de-identified form (this is in the [consumer terms](https://www.anthropic.com/news/updates-to-our-consumer-terms), not the retention help article).
3. A conversation flagged as a policy violation is retained for up to two years, and classifier scores for up to seven years.
4. Incognito conversations are never used for training.
Retention and public links are separate. Even with a 30-day retention period, a shared page will remain accessible until you revoke it yourself. For a separate explanation of what Claude keeps in memory between sessions and how that differs from an instruction file, see [“Claude Memory 2026”](https://ailoot.ai/blog/en/claude-memory-claude-md-auto-memory/).
## What should you do if chats contain customer data?
Key takeaway
First assess the scope, then revoke the links, then deal with search.
If customer data really was there, follow this order. Do the first three steps today and the rest tomorrow.
1. **Record what happened.** Open the lists of shared chats and artifacts, and write down every address and publication date. This is the complete list of what you have made public.
2. **Determine what is inside.** For every conversation, answer one question: did it include data that could identify a real person?
3. **Revoke all the links.** Start with those for which the answer to the previous question is yes.
4. **Request removal from search.** Start with Google’s personal information removal form, then Refresh Outdated Content, then Bing’s form.
5. **Change anything that served as a key.** Access tokens, passwords for control panels, connection credentials. A key that appeared on a public page is considered compromised whether anyone found it or not.
Tip
A separate note about temptation. News reports about this incident published search queries used to find other people’s conversations. Don’t repeat them. A page opening on its own is one thing; deliberately searching for, saving, and forwarding someone else’s material is another. The legal classification always depends on the circumstances and should be discussed with a lawyer; an article on the internet cannot help with that. Check only your own material: your address, your exact phrase, your domain.
## How to check your own material without intruding on someone else’s
Key takeaway
Check your saved share URLs and search for a distinctive phrase from your own conversation. To narrow phrase results, use the hosting domain, such as `site:claude.ai`, rather than your company’s domain. Missing results do not prove that a page is absent from the index.
1. ### Check your own addresses one at a time
Take a link from your list of shared chats and paste it in full into Google’s search bar as a regular query. A matching result confirms that Search is displaying it; no result does not prove that it is unindexed or private.
2. ### Search for your own phrase in quotation marks
Take a distinctive section of text from your conversation—6–10 unusual words—and enter it in quotation marks. The quotation marks tell search to look for an exact match. This will find the page even if the address has changed. A good query is your company name plus a rare word from the conversation.
3. ### Narrow a search for your own text
Search for your own distinctive phrase, company name, or address as text. You can add `site:claude.ai` to restrict those results to Claude’s hosting domain. `site:yourdomain.com` checks pages hosted on your website; it does not find Claude pages merely mentioning your domain. Restrict every query to your own material, and treat an empty result as inconclusive.
4. ### Repeat after revoking access
Run the same three checks again a few days later. Deindexing is not immediate, so it is worth checking for yourself.
These checks can find visible search results for your material, but cannot certify that no indexed or copied version exists. Verify revocation directly with the saved URL in a signed-out window.
## Where to start right now
Key takeaway
Fifteen minutes will address most of the risk. Open the list of shared chats, open the list of published artifacts, revoke whatever you no longer need, check in incognito, and change any keys that appeared. Then build a habit: before every click on Share, ask yourself what would happen if this page appeared in search tomorrow.
Here’s what makes sense to do today, before you forget:
1. Open `claude.ai/settings/data-privacy-controls`, find Shared chats, click Manage, and revoke anything you don’t need.
2. Open `claude.ai/artifacts` and unpublish anything you no longer need. Export any data first if the artifact stored something.
3. Check the revoked addresses in incognito mode.
4. Search for your saved share URL and a distinctive phrase from your own material; optionally narrow phrase results to `site:claude.ai`. Verify revoked links in a signed-out window even when search returns nothing.
5. Change any tokens and passwords that ever appeared in conversations.
6. Look at the training switch on the Privacy tab and choose its setting deliberately.
And one rule for the future. Before sharing a conversation, read it as if you were reading someone else’s page in search. If that makes you want to remove something, do it before clicking Share.
### Sources
- [Yandex Webmaster Help: removing a page from the index](https://yandex.ru/support/webmaster/ru/yandex-indexing/removing-from-index)
- [Claude Help: sharing and revoking chats](https://support.claude.com/en/articles/10593882-share-and-unshare-chats)
- [Claude Help: publishing artifacts](https://support.claude.com/en/articles/9547008-publish-and-share-artifacts)
- [Claude Help: what data you should not send](https://privacy.claude.com/en/articles/8325621-i-would-like-to-input-sensitive-data-into-my-chats-with-claude-who-can-view-my-conversations)
- [Claude Help: data retention periods](https://privacy.claude.com/en/articles/10023548-how-long-do-you-store-my-data)
- [Anthropic on updates to its consumer terms](https://www.anthropic.com/news/updates-to-our-consumer-terms)
- [OWASP LLM02:2025, sensitive information disclosure](https://genai.owasp.org/llmrisk/llm022025-sensitive-information-disclosure/)
- [UK NCSC on the risks of public language models](https://www.ncsc.gov.uk/blog-post/chatgpt-and-large-language-models-whats-the-risk)
- [Google: how to remove information from Search](https://developers.google.com/search/docs/crawling-indexing/remove-information)
Continue exploring Ailoot at [ailoot.ai](https://ailoot.ai/).
## Questions about Claude shared chats in Google: how to revoke your links
### Does an empty Google result mean my shared chat is private?
No. Search results can be incomplete, and indexing is separate from access. Open the saved share URL in a signed-out or incognito window to check whether revocation worked.
### Should I use my company domain to find a Claude page that mentions it?
Search for the company name, address, or a distinctive phrase as text. Add `site:claude.ai` to narrow the hosting domain; `site:yourdomain.com` searches pages on your own website.
## Ailoot · The company and its project portfolio
Ailoot combines established operating experience, a large client base, stable service and ongoing KPI control.
The company and its project portfolio: millions of customers; monthly sales in the billions.
Ailoot brings that operating experience to API access for AI features in customer products, agents, applications and automations.