Anything you type into a cloud chatbot is stored on the company’s servers under its retention policy, may be reviewed by staff for safety, may be used to train future models depending on your settings, and can be handed over in response to a legal request. That doesn’t make it reckless to ask a chatbot about a personal problem. It does mean deciding what goes in the prompt before you hit send.
The practical version: replace names with placeholders, cut account and ID numbers, generalize addresses and dates, strip location data from photos, and turn off training and history in the settings. For anything you can’t anonymize without losing the point, use a model that runs on your phone so the text never reaches a server at all.
What should you never paste into an AI chatbot? #
- Passwords, PINs, recovery codes and API keys
- Government ID numbers: Social Security, passport, driver’s licence, national insurance
- Financial account numbers: full card numbers, bank account and routing numbers
- Medical record numbers and insurance member IDs
- Other people’s private information, especially clients, patients, students or employees
- Confidential work material covered by an NDA or your employer’s policy. See using AI at work without leaking data.
- Photos with location data, or screenshots showing notifications, contacts or messages
What actually happens to what you type #
Policies differ by company and change often, but the shape is consistent:
- It’s stored. Your conversation sits on the provider’s servers so you can see your history.
- It may be reviewed. Providers flag some conversations for safety review, which can mean a person reads them.
- It may train future models. Many consumer plans use chats for training unless you opt out; business plans usually don’t by default.
- Deleting isn’t instant. Deleted chats are typically removed from active systems within a set window, with exceptions for legal and safety holds.
- Legal requests reach it. Anything a company stores can be subpoenaed.
- Bugs happen. In March 2023 a bug briefly let some ChatGPT users see the titles of other users’ conversations, as OpenAI disclosed.
None of that is unusual for an online service. It’s roughly the deal you already accept with email. The difference is that people tell chatbots things they would never put in an email. Do humans read your AI chats has the per-provider detail.
Which details carry the most risk? #
| Type of information | Why it’s sensitive | Safer approach |
|---|---|---|
| Health symptoms, diagnoses, medications | Hard to take back, and sensitive if it ever leaks | Describe generally, or use a local model |
| Details about other people | They didn’t agree to share it | Change names and identifying details |
| Relationship or family conflict | Deeply personal and easily identifying | Local model, or a person you trust |
| IDs, account numbers, addresses | Directly useful for fraud | Never paste them anywhere |
| Your routine and location | Together they reveal where you’ll be | Leave out the specifics |
| Work material | May break your contract or company policy | Check the policy first |
There’s a quieter version of this too. A chatbot doesn’t need a camera to learn about your state of mind; what you type tells it plenty. Systems that claim to read emotions from a face, a voice or word choice are really matching outward patterns, they misread people across cultures, and they’re easy to fool. Regulators treat the practice as risky: since 2 February 2025 the EU’s AI Act has banned emotion recognition systems in workplaces and schools, apart from medical or safety uses.
How do you anonymize a prompt? #
Privacy engineers use a handful of techniques before data is analyzed. The same ideas work on a single prompt.
1. Replace names with placeholders #
“My sister Rachel Kim hasn’t paid back the $2,300 she borrowed” becomes “My sister (Person A) hasn’t paid back money she borrowed.” The advice comes out the same, and the chatbot doesn’t know who anyone is.
2. Generalize the details #
Swap specifics for categories. “123 Oak Street, Austin” becomes “a rental in a mid-sized US city.” “Born March 4, 1988” becomes “in my late 30s.” “Diagnosed at St. Mary’s on June 2” becomes “recently diagnosed.”
3. Round or remove numbers #
Salaries, balances and dates can usually be approximated. “$87,450 salary” becomes “around $85k” whenever the exact figure doesn’t change the answer.
4. Cut what the question doesn’t need #
Most prompts carry context that’s there out of habit. Before sending, ask whether each detail changes the answer. If it doesn’t, delete it.
5. Watch for combinations #
Single details are rarely identifying alone. Together they are. Privacy researchers have shown that ZIP code, birth date and sex are enough to single out a large majority of Americans. Your job title, employer and city in one prompt do the same job.
How do you strip location from photos? #
- iPhone: in the Share sheet, tap Options at the top and turn off Location before sharing.
- Android: many gallery apps, Google Photos included, have a setting to remove location from shared photos. Check your gallery app’s sharing settings.
- Screenshots carry no GPS data, but check what’s visible on screen: names, notification banners, other messages.
Which chatbot privacy settings should you change? #
| Service | Setting | What it does |
|---|---|---|
| ChatGPT | Data Controls, “Improve the model for everyone” off | Stops your chats being used for training |
| ChatGPT | Temporary Chat | Not saved to history or used for training; kept briefly for safety |
| Gemini | Gemini Apps Activity, Keep Activity off | Stops saving chats to your account; Google still keeps them up to 72 hours |
| Claude | Privacy Settings, model training choice | Controls whether chats train models; changeable any time |
| Meta AI | Avoid personal topics entirely | Meta uses Meta AI interactions to personalize ads, with some sensitive categories excluded |
Sources: Gemini Apps Privacy Hub, Anthropic, Meta. Menu names move around, so search the app’s settings for “training” or “activity” if a path doesn’t match.
These settings limit what happens after your text arrives. They don’t stop it arriving, which is why removing the data first still matters.
Use a local AI to clean text before it goes to the cloud #
There’s a trick that gets you both. When you want a big cloud model’s answer but the text is full of personal details:
- Paste the text into an AI that runs offline on your phone.
- Ask it: “Rewrite this, replacing every person’s name with Person A, B, C, every company with Company X, every address with [address], and every phone number, email and account number with [removed]. Keep everything else the same.”
- Read the result and check it caught everything. Small models occasionally miss one.
- Send the cleaned version to the cloud chatbot.
The original never leaves your phone, and the cloud model only ever sees the anonymized version.
When should you skip the cloud entirely? #
Some things can’t be anonymized without losing the point: a letter from your doctor, a draft message to your partner, notes from a therapy session, a contract you need read line by line. For those, a model on your phone is the simpler answer, because there’s nothing to opt out of.
Personal LLM runs open models such as Qwen 3.5 4B, Gemma 4 E4B and Ministral 3 3B entirely on your phone. There’s no account and no server of ours, so chats, attached photos and documents stay on the device. It does make two kinds of network request: the one-time model download from Hugging Face, and AdMob ads in the free version, which are non-personalized on iOS if you decline tracking and don’t load at all offline. You can attach a PDF, text or Markdown file and it’s searched on the phone, and you can back everything up to a JSON file, which is plain text rather than an encrypted archive, so store it like any other sensitive document.
A local model is less capable than ChatGPT. For reading, summarizing and talking something through, it’s usually enough, and nobody else sees the question. If what you want to talk about is a personal problem rather than a document, talking to AI about personal problems privately covers what AI is and isn’t good for there.
Frequently asked questions #
Is it safe to put personal information into ChatGPT? #
It’s stored on OpenAI’s servers with your conversation and may be used for training unless you turn that off. Keep out identifiers such as ID numbers, account numbers and full names with addresses, and anonymize anything else sensitive before you send it.
Does turning off chat history protect my data? #
It helps. Chats aren’t kept in your visible history or used for training. The text still reaches the provider’s servers and is usually retained briefly for safety, so it’s more private, not invisible.
Can AI companies see what I type? #
Their systems process everything you send, and staff or contractors may review samples under the company’s policies. Removing personal details first, or using a model that runs on your own device, is what avoids that exposure.
How do I anonymize a document before using AI? #
Replace names with placeholders, remove ID and account numbers, generalize addresses and dates, and delete anything the question doesn’t need. An offline AI on your phone can do a first pass, but read the result before sending it anywhere.
Should I tell an AI chatbot my medical information? #
Share as little as the question needs, and never share record numbers or insurance details. For general questions about symptoms or medications, describe them without identifying information or use a model on your phone, and confirm anything that matters with a doctor or pharmacist.