AI can summarize a contract, explain a spreadsheet, or help draft a work email in seconds. The risk starts when you upload an entire file even though the tool only needs a small part of it. Privacy settings can reduce exposure, but they cannot make every upload risk-free.
A safer approach is to share less in the first place. Check how your AI tool handles data, remove details it does not need, and keep highly confidential material out of unapproved services. The steps below use ChatGPT as a practical example, but the same questions apply to other AI tools.
1. Check the AI tool’s privacy settings first
Before uploading a document, find the provider’s data or privacy settings. Look for three separate things: whether your content can be used to improve models, how long chats and files are retained, and who can access them. These are different issues, so switching off model training does not automatically delete data or make a shared chat private.
In ChatGPT, open Settings → Data Controls and review Improve the model for everyone. Turning this off means new conversations are not used to train OpenAI models, while your chat history can remain available. The available controls may differ by account and workspace. See the official ChatGPT Data Controls guide for current details.
For a sensitive question, you can also consider Temporary Chat. It does not appear in chat history, create or update memories, or get used to improve OpenAI models while it remains temporary. However, a copy may be kept for up to 30 days for safety purposes. Temporary Chat is not a promise that information is never retained.
2. Know what should stay out of an AI chat
Some information is too sensitive to upload to a general-purpose AI service, even when a privacy setting is enabled. Unless your organization has approved a specific tool and workflow, keep these items out:
- Passwords, recovery codes, API keys, private keys, and authentication tokens.
- Bank details, payment card numbers, tax records, and identity documents.
- Medical records or sensitive personal information about you or someone else.
- Confidential client files, internal business plans, unreleased financial data, or documents covered by a non-disclosure agreement.
- Source code, customer records, or private messages that you do not have permission to share.
If a file must not leave your device or organization, do not upload it to a public AI tool. Redaction helps with lower-risk tasks, but it is not a substitute for permission to share the material.
3. Share only the information the AI needs
You often do not need to upload the complete file to get a useful answer. A smaller input is easier to review and reduces the amount of information exposed if something goes wrong.
- Define the task. If you need help understanding one contract clause, ask about that clause rather than submitting the whole contract.
- Copy only the relevant excerpt. Remove unrelated pages, attachments, customer lists, and background details.
- Replace identifying information. Change real names to “Client A,” addresses to “[ADDRESS],” and account numbers to “[ACCOUNT NUMBER].” Keep only the details necessary for the question.
- Inspect the document before sharing. Comments, tracked changes, headers, footers, hidden sheets, and file properties may contain names or other information that is not obvious in the main text.
- Review the prompt itself. Do not paste private information into the instructions if the answer can be produced without it.
4. Watch for sharing links and connected apps
- Shared conversation links: Check whether a chat has been shared and who can open the link. Remove links you no longer need, especially if the conversation contains work details.
- Connected apps: An AI tool connected to email, cloud storage, or a calendar may access information permitted by the connection. Review permissions and disconnect integrations you no longer use.
- Browser extensions: Extensions with permission to read or change website data may be able to access information displayed in a browser. Install only extensions you trust and review their permissions.
- Screenshots and copied text: A screenshot or copied chat can end up in a synced folder, shared workspace, or clipboard history. Treat these copies as carefully as the original.
If you need to save or share an AI conversation, use the service’s intended controls and check the destination before sending it. Our guide to exporting or sharing AI conversations covers common options and problems.
5. Be careful with work and school accounts
Before using AI with company, client, or school information, check your organization’s rules. Some organizations prohibit public AI tools for confidential data and provide an approved alternative. A managed account may also have different data terms or administrator access than a personal account.
Do not assume that paying for a plan automatically makes every use appropriate. Confirm which service and account type are approved, what information may be submitted, and whether the provider’s terms meet your organization’s requirements. If the policy is unclear, ask the responsible IT or security contact before uploading the file.
When an app asks for access to files, contacts, email, or storage, grant only the permissions required for the task. You can also review and revoke unnecessary permissions; see our guide to reviewing and revoking app permissions.
6. Consider running AI locally for sensitive documents
If you regularly work with confidential text, a local AI model may be a better option. Tools such as LM Studio and Ollama can run compatible models on your own computer. With a model running locally and no cloud features involved, your prompts and documents can stay on the device rather than being sent to a hosted AI service.
There are trade-offs: local models need storage and memory, and may be slower or less capable than hosted services. Check the configuration too, because cloud models, web search, or connected features can send data outside your computer.
7. If you already uploaded a private file
Do not assume that deleting one chat removes every copy associated with it. Check the provider’s retention guidance and delete the conversation and any separately saved file or shared link where applicable. In ChatGPT, files saved in Library can be stored separately from the chat, so deleting the conversation alone may not remove the Library copy. See the official chat and file retention guidance.
If you accidentally shared credentials such as a password or API key, revoke or rotate them promptly. If the file contained client or workplace information, follow your organization’s incident-reporting process rather than relying only on deleting the upload.
A quick privacy checklist before using AI
- Have I checked the tool’s model-training and retention settings?
- Is this service approved for the information I want to share?
- Can I get the same result with a short excerpt instead of the full file?
- Have I removed identifiers, comments, hidden data, and unnecessary details?
- Could a shared link, connected app, or browser extension expose the content?
- Would a properly configured local model be more suitable?
The most reliable privacy habit is simple: give an AI tool the minimum information needed to complete the task. Settings, redaction, and local models can all help, but choosing not to upload a sensitive file is still the safest option when you do not have a clear reason or permission to share it.