This dataset holds real conversations that people published from ChatGPT, Claude, Gemini, Grok and other assistants, collected from the open web. It contains personal information people chose to share and material that is offensive, explicit or harmful. Access is approved by hand, for research. By requesting access you agree to: use the dataset under CC BY-NC 4.0 (non-commercial, attribution), the terms the embedded ShareChat rows carry; make no attempt to identify the people in these conversations or to infer sensitive personal data about them; apply your own filtering and safety measures before training or evaluating models on it; respect the terms of service of the platforms the conversations came from; not redistribute the dataset; and delete any conversation the maintainers notify you has been removed.

sharetrawl

244,484 publicly-shared LLM conversations across 9 platforms including toxic output.

Last updated: 2026-09-09

This dataset extends ShareChat (paper) and is updated weekly. 75,226 of its 244,484 urls came from ShareChat's list (31%) rather than from our own discovery.

Have share links this corpus is missing? Paste them at https://sharetrawl-submit.hails.workers.dev

Motivation

Public chat datasets lag live traffic by 6 to 12 months (WildChat-4.8M → July 2025; ShareChat → October 2025); and often redact harmful/toxic output (e.g. WildChat-Full). This limits research into in-the-wild safety harms and makes benchmarking monitors on real-world use-cases challenging.

Composition

platform	conversations
chatgpt	114,198
grok	80,297
gemini	18,967
perplexity	17,696
claude	7,936
manus	2,126
qwen	1,151
deepseek	1,124
kimi	989
total	244,484

Time distribution

The earlier of created_at (when the conversation happened) and captured_at (when we fetched it).

year	conversations
2022	8
2023	16,604
2024	27,769
2025	85,604
2026	104,778 (to 2026-09)

234,763 of 244,484 conversations carry one of the two dates; the remaining 9,721 appear in no year above, having neither.

Harm labels

labels/sharetrawl_broad_labels.parquet scores 243,997 conversations with a two-stage cascade: a cheap gate (z-ai/glm-5.3-flash) admits anything scoring ≥ 5, and a stronger oracle (claude-opus-4-8) gives each admitted conversation a 0–100 score and a list of categories. Both scores are stored (gate_score, opus_score); flagged is oracle score ≥ 50, and 14,998 (6.15%) are flagged.

Evidence window: whole-conversation (labelled 2026-09-08, declared in labels/METADATA.json): both stages read the whole conversation, in windows of 40,000 characters with the strongest verdict kept (n_windows, windowed).

51 rows (50 of them flagged) have no url at all.

The gate's misses are measured: on 2026-09-08, 2,000 gate-rejected conversations were scored by the oracle and 1 of 2,000 came back flagged — a false-negative rate of 0.05% (95% CI 0.01–0.28%), or roughly 76 missed flags (at most 429) across the 151,783 rejected. The true rate over the labelled subset is therefore likely near 6.18% (at most 6.32%), not 6.15%.

By category

A conversation can carry several categories, so these sum to more than the flagged total. Categories with 10 conversations or fewer are omitted.

category	conversations
misinformation	12,564
deception	6,807
defamation	4,057
hate_harassment	2,424
privacy	2,253
sexual	1,921
other	1,776
jailbreak	1,173
illicit	1,099
self_harm	783
violence	503
unknown	496
cyber	483
cbrn	326
harassment	251
harassment_hate	20

By platform

platform	flagged	scored	rate
grok	8,318	80,196	10.37%
kimi	91	989	9.20%
deepseek	96	1,100	8.73%
claude	574	7,847	7.31%
qwen	57	1,148	4.97%
chatgpt	4,714	114,008	4.13%
manus	86	2,122	4.05%
gemini	660	18,925	3.49%
perplexity	402	17,662	2.28%

By source slice

slice	flagged	scored	rate
sharetrawl	14,562	234,280	6.22%
sharechat	436	9,717	4.49%

The gap is primarily platform mix, not corpus: within platform, text-deduplicated, the two are broadly comparable.

To break the rate down by where a URL was found, group on provenance_source; it is set on 154,392 of 243,997 scored conversations, absent on the earliest-discovered rows, and thin enough per backend that small denominators dominate.

Turn-level labels

The cascade above scores whole conversations. Separate classifier layers additionally score every text-carrying turn, which is the unit ShareChat and WildChat report on.

layer	model	flagged when	flagged	scored	rate	coverage
Detoxify	`unitary/toxic-bert`	`toxicity >= 0.5`	33,645	1,985,426	1.69%	79.9%
Llama Guard 3 1B	`meta-llama/Llama-Guard-3-1B`	`p_unsafe >= 0.9`	95,373	1,985,426	4.80%	79.9%
OpenAI Moderation †	`omni-moderation-latest`	`flagged`, the file's own boolean	39,803	1,426,296	2.79%	57.4%
Broad cascade (turn-level)	`claude-haiku-4-5-20251001 → claude-opus-4-8`	`flagged`, the file's own boolean	72,977	2,451,844	2.98%	98.7%

† OpenAI Moderation is still being scored. It walks the corpus in file order, so its coverage concentrates in the platforms early in the scan and is not a random sample — group by platform before trusting its rate.

Data structure

One row per conversation (not per message, unlike ShareChat's CSV release), with the turns nested in a messages list.

column	meaning
`platform`	responder platform (`chatgpt`, `grok`, `gemini`, `perplexity`, `claude`, `manus`, `qwen`, `deepseek`, `kimi`)
`url`	the public share URL
`source`	whose copy of a conversation this row is — `sharechat` (base census) or `sharetrawl` (our own capture) — not which corpus first found it
`provenance_source`	which discovery backend found the URL (`github`, `wayback`, …)
`provenance_ref`	the exact item that surfaced it — an archive snapshot, a scan record, or the public post, repo file or forum thread where the link was shared
`model`	responder model, where the platform discloses it
`created_at` / `published_at`	conversation timestamps, where available
`captured_at`	when we captured it — set only on fresh rows
`topic` / `language`	classified topic and language — ShareChat's labels on base rows; `language` on our own captures is identified by Claude Sonnet
`turns_count`	number of turns
`messages`	list of `{message_index, role, plain_text, thinking, code, analysis, version}`

published_urls.sha256 lists the sha256 of every url any retained revision has carried since the repository's history was last purged, one per line — a superset of this revision's rows, label files included. It is how a publish knows whether a since-withheld conversation was ever public (see Removal requests), and it lets you check whether a url has appeared in this dataset without downloading the parquets.

How the fresh slice is collected

Share URLs are discovered by unioning many backends — web archives, passive-scan corpora (urlscan.io, AlienVault OTX), code search (GitHub, SourceGraph), social/forum search (Bluesky, Reddit, Hacker News, Lemmy) and WeChat public-article search (Sogou) — then de-duplicated against what is already stored. Each URL is rendered in a real browser (please reach out for the HAR files).

Safety and exclusions

Child-safety material is excluded via an automatic screen that runs before every publish and fails closed — a classifier refusal quarantines rather than passes, and a capture whose screen call did not complete is withheld until a later run clears it. Quarantined conversations are held in a content-free denylist of hashed URLs (no text, no URLs) and never enter the corpus. In the label file, rows categorised csae retain the score and category but have url and id blanked.

These are real conversations from the open web. They contain personal information people chose to share, and material that is offensive, explicit, or harmful.

Removal requests

If you are in one of these conversations and want it removed, or you hold rights in one, open a discussion on this dataset's Community tab with the share URL (the url value). A removed conversation leaves the corpus at the next weekly publish, and that publish purges the repository's history (squashes it to one commit), so the conversation does not persist in an earlier revision. Otherwise revisions are kept. Removals are recorded as a content-free list of hashed URLs, never as the URL itself.

Limitations

Shared conversations are not representative of all usage. People share what is interesting, impressive, funny, or outrageous.
Platform mix is uneven and shifts over time, driven by what is discoverable rather than by real platform share.
Harm labels are model judgements, not human annotated nor the truth.

Citation

Please reach out to me for a citation, as the major work is not yet released.

Cite ShareChat as well:

@misc{yan2026sharechatdatasetchatbotconversations,
  title         = {ShareChat: A Dataset of Chatbot Conversations in the Wild},
  author        = {Yueru Yan and Tuc Nguyen and Bo Su and Melissa Lieffers and Thai Le},
  year          = {2026},
  archivePrefix = {arXiv},
  primaryClass  = {cs.CL},
  url           = {https://arxiv.org/abs/2512.17843},
}

License

CC BY-NC 4.0, inherited from ShareChat — this dataset embeds the ShareChat corpus, whose data structure and distribution are licensed CC BY-NC 4.0 under the ShareChat Dataset License Agreement, so the original terms apply to the whole of it. Non-commercial use only, attribution required. The licence covers the compilation and our labels; the conversations themselves were written by their participants and the responding models, and the originating platforms' terms of service continue to apply to that content.

ShareChat's community guidelines carry over, and access here is granted on the same terms: make no attempt to identify the people in these conversations or to infer sensitive personal data about them; apply filtering and safety measures before training or evaluating on this data; respect the terms of service of the originating platforms; comply with applicable law and your institution's ethical review; the views in the conversations are not those of the maintainers; and the dataset is provided as is, without warranty of any kind.

Downloads last month: 599

Total file size:

2.45 GB

Paper for DJRHails/sharetrawl

ShareChat: A Dataset of Chatbot Conversations in the Wild

Paper • 2512.17843 • Published Dec 19, 2025 • 2