Privacy: what never to paste into an AI tool
Anything you type into an AI tool leaves your device. Learn what to never paste, how to redact data, which settings to check, and how work rules and India's DPDP Act apply.
When you type into an AI chatbot, your text is sent over the internet to a company's servers. That is how it works; the model does not run on your phone. So the question is not whether the AI is clever, but what happens to what you sent.
This lesson gives you a simple rule for deciding what is safe to paste, and habits that protect you, your friends and your employer.
What can happen to your data
Policies differ between companies and between free and business plans, and they change, so always read the current privacy page of the tool you use. In general, these things can happen to what you type:
- The company stores your conversations, at least for some time. - On many consumer plans, conversations may be used to improve the models, unless you turn that setting off. Business and education plans often do not use your data for training by default. - Some conversations may be reviewed by humans for safety or quality. - Your account can be breached, or a chat shared by link can be seen by others. - A model can occasionally repeat something it saw in training, which is one reason companies are careful about what goes in.
A simple test
Treat every prompt as something that could be read by someone you did not intend. If you would not be comfortable seeing it on a public notice board, don't paste it.
Never paste these
Data that should stay out of AI tools
| Category | Examples | Why it is risky |
|---|---|---|
| Passwords and secrets | Passwords, OTPs, API keys, private keys, .env files, database connection strings | Anyone who sees them can log in as you or run up bills |
| Government and financial IDs | Aadhaar number, PAN, passport, bank account or card numbers, UPI PIN | Identity theft and fraud |
| Other people's personal data | Customer lists, student records, phone numbers, emails, chat screenshots with names | You do not have their permission to share it |
| Health and legal records | Medical reports with your name, case files, HR complaints | Very sensitive, hard to undo |
| Company confidential | Source code of a private repo, unreleased plans, client data, contracts, internal documents | Usually breaks your employment contract and company policy |
| Exam and assessment material | Live exam papers, proctored test questions | Breaks rules and may get you disqualified |
Notice that this is not only about you. A fresher who pastes a client's customer data into a free chatbot to 'clean it quickly' can cause a real data leak for the company. Several large companies have restricted or banned staff from using public AI tools for work for exactly this reason.
Redact before you paste
You often can still get help without sharing the sensitive part. Redact (hide or replace) the private details and keep the structure. The AI doesn't need the real values to help with your problem.
Same question, safer input
| Original | Redacted version |
|---|---|
DB_URL=postgres://admin:Sup3rS3cret@10.2.4.5/orders | DB_URL=postgres://USER:PASSWORD@HOST/orders |
Rahul Sharma, 98xxxxxx21, Aadhaar 1234 5678 9012 | [NAME], [PHONE], [AADHAAR] |
Our client Acme Bank wants a loan model | A client in banking wants a loan model |
| A real customer table with 5,000 rows | 5 invented rows with the same columns |
For code, remove keys and passwords, replace company names and internal URLs, and share only the smallest piece needed to reproduce the problem. For data, use fake sample rows. If you already pasted a secret by mistake, treat it as leaked: change the password or revoke the key immediately. Deleting the chat is not enough.
Settings and tool choices
Habits that protect you
- Find the data or privacy settings of each tool and check whether your chats are used to train models; turn it off if you prefer
- Know what a 'temporary' or 'incognito' chat mode does in your tool; it usually means the chat is not saved to your history or used for training, but read the tool's own description
- Be careful with 'share chat' links: anyone with the link may read the chat
- Use your company's approved AI tool for work, if one exists, rather than a personal account
- Be careful with browser extensions and apps that 'add AI'; each is one more company that sees your data
- For truly private material, consider a model running on your own computer (for example with Ollama), where the text doesn't leave your machine
Rules you may be bound by
Your employer or college. Many workplaces have an AI policy that says which tools are allowed and what data may go in. Ask your manager or read the policy before using AI on work material. Not knowing is not a defence.
The law. India's Digital Personal Data Protection Act, 2023 (DPDP Act) sets rules for how personal data of individuals is collected and processed, and it puts duties on the organisations that handle it. If your job involves customer data, sending it to a third-party AI tool without approval can create legal and compliance problems for your organisation. You are not expected to be a lawyer, but you are expected to ask before sharing personal data. For details, read the official text or ask your company's compliance team.
How this comes up in interviews
Interviewers for developer and analyst roles sometimes ask: "How do you use AI at work, and what do you avoid?" A strong answer is specific: you use AI for explanations, boilerplate and review, you never paste secrets, customer data or private code into public tools, you redact examples, and you follow the company policy. This signals maturity more than any tool name.
Try it: Redact a real prompt
Take a prompt you sent to an AI tool recently (or invent one about a work or college project). Find every item that is private: names, numbers, keys, internal URLs, client names. Rewrite it with placeholders so the AI could still help. Then open your tool's privacy settings and note whether your chats can be used for training.
Key takeaways
- Everything you type is sent to a company's servers; check each tool's current privacy settings.
- Never paste passwords, API keys, ID numbers, other people's data, health or legal records, or company confidential material.
- Redact: replace real details with placeholders, and use fake sample data.
- If a secret was pasted, change or revoke it at once; deleting the chat is not enough.
- Follow your employer's or college's AI policy, and remember the DPDP Act applies to personal data.
- Showing good privacy habits is a real advantage in interviews and at work.
Check yourself
Finishing the quiz marks the lesson as done.
1. You pasted an API key into a chatbot by mistake. What is the right response?
2. You need help fixing a SQL query on your company's customer table. What is the safest approach?
3. Which statement about AI tool privacy is most accurate?
4. Why can pasting customer data into a public chatbot be a problem even if the AI answer is helpful?
5. What does a 'temporary chat' mode usually do?
Saved on this device. Create a free account to keep it on every device.
Practise this with Sam
A real mock interview, out loud, with an honest scorecard. Free to start.