A chatbot feels like a private conversation. Text goes into a box, a reply comes back, and nobody else seems to be involved. That feeling is the problem. Behind the box sits a company, a set of servers, a privacy policy, and sometimes human reviewers. What a person types can be stored, analyzed, and in some cases used to improve future products.
None of this means AI tools should be avoided. It means users benefit from knowing what they are handing over and making that choice deliberately. This guide covers what to keep out of a chatbot, which settings matter, and habits that protect privacy without making the tools useless. It is practical guidance, not legal advice. Laws, company policies, and product features vary and change, so the guide points to what to check rather than promising how any one product behaves.
The short answer: what should never go into a chatbot?
Passwords, payment card numbers, government ID numbers, private keys, and anything that would let someone access an account or impersonate a person should never be pasted. Medical, legal, financial, and workplace-confidential details, along with other people's personal information, call for great caution. A good rule: if something would not be posted on a public forum, it should not be pasted into a chatbot unless the tool's handling of data has been checked.
Where typed words actually go
A simple mental model supports good decisions. Details differ by product, but the general pattern is this.
Step 1: The text travels to a company's servers
In most cases the model does not run on a phone or laptop. The message is sent over the internet to the provider's systems. It is processed there, and the reply is sent back. What the model does with text once it arrives is explained in how large language models work.
Step 2: The conversation may be stored
Many services keep chat history so a user can return to it. Even after a chat is deleted from view, the company may retain it for some period for safety, legal, or operational reasons. Retention rules vary by product and plan.
Step 3: It may be used to improve the product
Some services use conversations to train or evaluate models, depending on settings and plan. Others say they do not use business or paid-tier data that way. Policies differ and change. Settings that mention "improve the model for everyone," "training," or "data controls" are the ones to look for.
Step 4: People may read some conversations
Companies commonly have processes for reviewing conversations that are flagged for safety or abuse, or for quality evaluation. That can involve human reviewers, with various protections. The privacy policy explains what applies.
Step 5: Others may gain access in other ways
Accounts can be hacked. Shared devices can show chat history. Legal processes can compel companies to hand over data. Browser extensions that read pages can see what is typed. A leaked or shared conversation link can expose a chat to anyone who has it.
Step 6: Models can occasionally repeat things
It is generally uncommon for a model to reproduce a specific private input in an answer to a stranger, but it cannot be ruled out entirely, especially for distinctive text that is repeated in training. The bigger practical risk is data exposure through storage, account compromise, sharing, and human review, not a chatbot revealing secrets to another user. Still, the safest data is data that was never entered.
The never-paste list
These items belong outside general-purpose chatbots.
Credentials and secrets
- Passwords and passphrases.
- One-time codes, recovery codes, and security answers.
- API keys, access tokens, and private keys.
- Database connection strings and server credentials.
- Wi-Fi passwords and door or alarm codes.
When debugging code, keys and secrets should be removed first and replaced with placeholders such as YOUR_API_KEY. A real secret that gets pasted by accident should be treated as compromised and rotated right away.
Payment and banking details
- Full credit or debit card numbers, expiration dates, and security codes.
- Bank account and routing numbers.
- Online banking logins.
- Full tax returns or payroll records with identifying details.
Help with understanding a bill or statement is still possible if the numbers are hidden or replaced first.
Government and identity numbers
- Social Security numbers and national ID numbers.
- Passport, driver's license, and visa numbers.
- Full date of birth combined with full name and address.
- Copies or photos of identity documents.
This combination is what fraudsters use for identity theft. It does not belong in chat windows.
Other people's private information
Friends, family members, customers, patients, students, and coworkers did not agree to have their details shared with an AI company. Names, addresses, phone numbers, health information, and private messages about identifiable people are best left out. Describing the situation in general terms works instead: "a coworker who keeps interrupting meetings" rather than a full name and an email thread.
Information bound by law or contract
Examples include client data, trade secrets, unreleased financials, source code under confidentiality terms, and anything covered by a nondisclosure agreement. Many employers have rules about this. When in doubt, the safe assumption is that the information is protected until the employer says otherwise.
Content that identifies a child
Children's full names, schools, photos, locations, and other identifying details should not be shared. A guide to AI tutors for gifted kids covers guardrails for children's use.
The be-careful list
These categories are not an automatic no. They call for thoughtful decisions, a check of the tool's settings, and sharing the minimum necessary.
Health information
People often ask chatbots about symptoms, medications, and test results. General questions are fine: "What does elevated cholesterol mean?" Pasting a full medical record with a name, birthdate, and provider calls for more caution, and identifiers can be removed. A chatbot is also not a clinician and can be wrong, as explained in why AI makes things up. Anything that affects care belongs with a qualified professional. In an emergency, emergency services are the right contact, not a chatbot.
Legal matters
General questions about how a legal process works are reasonable. Pasting a confidential contract, a settlement draft, or details of an active case deserves serious thought, because sharing privileged communications with a third-party tool could create problems. Legal advice comes from a lawyer, who can also explain their own rules for AI tools.
Financial details
General budgeting questions are fine. Account numbers, exact balances tied to an identity, and full statements are better kept out. For help analyzing a spreadsheet, names and account numbers can be removed first, or made-up sample numbers with the same structure can be used.
Work documents
Meeting notes, emails, plans, and code can be useful to summarize or improve. Before pasting, useful questions include whether the material is confidential, whether permission exists, and whether the employer provides an approved tool with stronger data protections. A company policy, where one exists, governs.
Location and routine
Home address, daily schedule, travel plans, and photos with identifiable backgrounds can reveal more than intended. Extra thought is warranted when asking for advice about a stalker, an abusive ex, or any safety situation. In those cases, a trusted person or a support organization is a good point of contact.
Emotional confessions
People do confide in chatbots, and some find it comforting. A chatbot is not a person bound by confidentiality, and the words are stored by a company. For someone in distress, a trusted person, a qualified professional, or a local crisis service is the right resource.
Images, audio, and files
Photos can contain faces, location data, documents in the background, and metadata. Screenshots can include notifications, tabs, and personal information. Cropping and reviewing before uploading is wise. Voice conversations may be recorded and transcribed, so audio retention settings are worth checking.
The safe-to-share list
For perspective, much of what people do with chatbots carries little privacy risk.
- General knowledge questions.
- Drafting a generic email, cover letter, or social post with placeholder details.
- Brainstorming names, ideas, outlines, and plans.
- Explaining concepts and homework-style problems (without student identifiers).
- Rewriting text about oneself that would be fine to publish.
- Coding help with sanitized samples.
- Practicing a language or a conversation.
The point is not to be afraid. The point is to share on purpose.
Settings that matter
Every product names things differently and changes its menus often, so this section describes categories. Ten minutes spent finding each one in the tools in use is time well spent.
1. Training and data-use controls
Look for a setting about whether conversations can be used to improve the models, and turn it off if that is the preference. Some services handle this differently for free, paid, business, and education accounts. Business and enterprise plans often have stronger commitments, which are best verified by reading the terms.
2. Chat history
Some tools allow turning off history, which can reduce what is stored or shown in an account. Others offer temporary or incognito-style chats that do not appear in history and may be deleted after a time. What the mode actually does is worth reading. "Temporary" rarely means "never stored at all."
3. Memory and personalization
Several assistants can remember details about a user across chats. That can be handy and it can also store sensitive facts. Reviewing what has been remembered, deleting anything unwanted, and turning memory off are all options.
4. Deleting data
It helps to know how to delete individual chats, all history, and the account itself, how long deletion takes, and what copies might remain. The provider's retention statements explain this.
5. Sharing links
Many tools can generate a link to share a conversation. Anyone with that link may be able to view it, and some links can be indexed or found. A chat should be read through for private details before sharing, and shared links should be reviewed and removed periodically.
6. Connected apps and permissions
Assistants that connect to email, calendar, files, or cloud storage can read what they are given access to. The smallest permission that gets the job done is the sensible grant. Connected apps merit regular review, and unused ones can be removed. Tools that can take actions, such as sending messages or editing files, deserve extra care, a point explained in a guide to AI agents.
7. Account security
A strong, unique password in a password manager, plus multi-factor authentication, protects an account. An account takeover exposes the entire chat history. Logging out on shared devices adds protection.
8. Browser extensions and integrations
Extensions that "add AI to any page" can read and sometimes transmit page content, including what is typed. Installing only trusted ones, reviewing permissions, and removing unneeded ones reduces risk.
9. Location, camera, and microphone permissions
Mobile apps can request access to location, photos, microphone, and camera. Granting only what a feature needs, and revoking unused access, is good practice.
10. Data export and activity logs
Some services allow downloading data or viewing activity. These tools help audit what is stored.
How to sanitize before pasting
To get the benefit of a chatbot without the exposure, the identifying parts can be stripped first.
A simple process
- Decide the goal. Often the structure of the problem matters, not the details.
- Replace names with roles or placeholders: "Client A," "the manager," "the vendor."
- Replace numbers with fake values that keep the shape: dollar amounts, dates, account numbers.
- Remove locations and unique identifiers: addresses, license plates, ticket numbers, order numbers.
- Summarize instead of pasting. Describe the situation in general words.
- Review the text one more time before sending.
- Restore details after the answer comes back.
Before and after
An example of a prompt before sanitizing: "Draft a reply to Jane Doe at 42 Maple Street about invoice 10482 for $3,840 that is 45 days overdue. Her phone is 555-0100."
The same request after sanitizing: "Draft a polite but firm reply to a customer about an invoice that is 45 days overdue. Mention a payment link and offer a payment plan. Use placeholders for the name, amount, and invoice number."
The second version produces the same kind of draft with none of the private details.
Use synthetic data for testing
When building a spreadsheet, a database, or a report, the tool can generate sample data with the right structure. Testing with that, rather than real records, keeps real data out of the chat.
For code
- Remove secrets and credentials.
- Replace real domain names, server names, and customer data with placeholders.
- Proprietary code should be pasted only if the employer allows it and the tool's terms fit the need.
- Production data stays out of debugging sessions.
At work: personal accounts versus company tools
Many data leaks happen not through hacking but through well-meaning people pasting work material into personal accounts.
Know the policy
Employers may have an approved AI tool, and its coverage is worth understanding. Approved enterprise tools often come with contractual data protections, administrative controls, and rules about retention. Personal consumer accounts usually do not.
Personal accounts and confidential work
If an employer has not approved a tool, confidential material is generally off limits. Even when a tool is convenient, the consequences of a breach can be severe, including discipline or legal liability.
Regulated information
In healthcare, finance, education, law, government contracting, or any area with specific data rules, stricter requirements usually apply. Compliance, legal, or security teams are the right people to consult before using AI with that kind of data.
Small businesses
A small business owner may be the whole compliance department. A one-page rule helps: approved tools, banned data, and who reviews customer-facing text. An explainer on AI for small business includes a starter approach. Customer lists, payment information, and private photos of customers' homes deserve extra care.
Teachers and schools
Student records are sensitive and often regulated. Only tools a school approves should be used, and local rules apply.
Safety beyond privacy
What not to tell a chatbot is also about what not to trust it with.
Answers are not verified
Chatbots can be wrong and sound certain. They are not a sole basis for medical, legal, financial, or safety decisions. Cross-checking with reliable sources and professionals is the safer path.
Scams that use AI
Fraudsters use AI to write convincing messages and to imitate voices. When someone known asks for money or credentials in an unusual way, verifying through another channel, such as a phone call to a number already on file, is standard advice. Some families agree on a code word for emergencies.
Links and downloads
Unfamiliar links and code should not be run just because a chatbot suggested them. Checking the source matters. If a chatbot recommends installing something, independent verification comes first.
Prompt injection and hidden instructions
When an assistant reads web pages, emails, or documents, text hidden inside them can try to steer the assistant. This is called prompt injection. A tool that browses or acts on a user's behalf is best given no more access than it needs, with actions reviewed before approval.
Fake AI apps
Copycat apps and sites imitate popular chatbots to harvest logins and data. Apps from the provider's official site or official app store listing, with the developer name verified, are the safer choice.
Emotional safety
Chatbots can seem caring, but they are not people and they are not therapists. They are not a source of crisis support. Trusted people, local professionals, and emergency resources fill that role.
Special cases
Kids and teens
Adults can set up accounts for children, review the settings, and teach a never-share list. Each service's age rules apply. For younger children, keeping conversations visible to a trusted adult is common practice.
Journalists, activists, and people at risk
People at heightened risk from surveillance or legal pressure benefit from thinking carefully before entering any sensitive information into any online service. Digital security guidance from reputable organizations in the relevant field is available.
Creative writers and designers
Drafts and unreleased projects may be valuable. It is worth checking whether a tool uses inputs for training, and considering keeping the most sensitive or original material out. For image tools, an article on AI image generators compared covers licensing and upload considerations.
Researchers and professionals with confidential data
Institution-approved tools with documented data protections are the first choice. When none exists, thorough anonymization or skipping AI for that part of the work are the alternatives.
Running models locally
Where privacy is a top concern, some open models can run on a personal computer so the text never leaves the machine. This takes setup and decent hardware, and the quality may differ from large hosted models. An article on Meta AI and Llama discusses the open-weights approach. Local does not mean automatically safe: the device still needs securing.
What to do after sharing something sensitive
Panic is not necessary. Steps in order of severity:
- Stop and assess. What was shared, and how sensitive is it?
- Delete the conversation from history, and check any memory entries. Deletion may not erase every copy immediately.
- Change credentials. A shared password, key, or token should be changed or rotated right away, and multi-factor authentication turned on.
- Contact the bank or card issuer if payment details were shared, and watch statements.
- Monitor for identity theft if identity numbers were shared. A credit freeze or fraud alert may be appropriate, following guidance from the country's consumer protection agency.
- Tell the employer if confidential work data was shared. Reporting early is better than hiding it.
- Check data-use settings and opt out of training if desired.
- Learn from it. A habit or template for sanitizing helps next time.
Building a personal AI privacy routine
Habits beat willpower. A routine takes only minutes.
One-time setup (30 minutes)
- Pick the tools actually used and drop the rest.
- Open the privacy and data settings for each. Turn off training use if preferred.
- Review memory and delete anything unwanted.
- Enable multi-factor authentication and use a password manager.
- Review connected apps and permissions.
- Bookmark each tool's privacy policy and terms.
Every time something is pasted (5 seconds)
A useful question: would it be acceptable if this appeared in a leaked file? If not, sanitize or skip.
Every few months (15 minutes)
- Delete old chats that are no longer needed.
- Review shared links.
- Revisit settings, since updates sometimes change defaults.
- Remove unused apps and extensions.
When policies change
Companies update their terms. Skimming announcements about data practices is worthwhile. If a change causes discomfort, adjusting settings or switching tools are options. Reviews of ChatGPT, Claude, and Gemini explain the general approaches, but the live policy pages hold the current details.
Quick takeaways
- A chatbot is a service run by a company, not a private notebook.
- Passwords, keys, payment numbers, and government ID numbers never belong in a chat.
- Health, legal, financial, and work-confidential information, and anyone else's personal details, call for care.
- Sanitize before pasting: replace names, numbers, and locations with placeholders.
- The data-use, history, memory, sharing, and connected-app settings in every tool are worth finding and reviewing.
- A password manager and multi-factor authentication protect chat history.
- At work, approved tools are the right place for confidential material.
- A chatbot alone is not a sound basis for medical, legal, or financial decisions.
- After sharing something sensitive: delete it, rotate credentials, and tell the right people.
- Each provider's current privacy policy and terms are the authority, since they change.
FAQ
Do chatbots read conversations?
Automated systems process them, and some providers have limited human review for safety, abuse prevention, or quality. The details depend on the product, the plan, and the settings. The privacy policy explains what applies.
If a chat is deleted, is it really gone?
It is removed from view, and often from the provider's active systems after some period, but retention can vary. Providers may keep data for security, legal, or operational reasons. The provider's stated retention and deletion policy is the reference.
Is incognito or temporary chat mode private?
It reduces what is saved in account history, and some providers say temporary chats are not used for training. It does not make input invisible to the company. Each product's own documentation explains what the mode does.
Is it okay to ask a chatbot about health?
General questions are usually fine. Identifying details and full records are better left out, and answers should not be treated as medical advice. A qualified clinician is the right source for decisions about care, and emergency services handle emergencies.
Can a chatbot be used for work documents?
Only if the employer permits it, and ideally through an approved tool with proper data protections. Confidential, regulated, or client information does not belong in personal accounts without clear permission.
Are paid or business plans more private?
Often they come with stronger data commitments, such as not using content for training and more administrative controls, but this varies. Assumptions are risky. The plan terms and data processing information for the specific product are the sources.
What is the safest way to use AI with sensitive material?
Share as little as possible, sanitize what is shared, use approved tools with strong data terms, or run a model locally given the skills and hardware. For truly sensitive work, a security or legal team can advise before AI is used at all.
Can a chatbot leak information to other users?
It is uncommon for a model to hand one user's private input to another, but it cannot be treated as impossible, and other exposure paths are more likely: account compromise, shared links, stored history, and human review. The simplest protection is not entering what cannot be exposed.