Sharing Safely With AI Assistants

Usually under Data Controls, Privacy, or Improve the model. On consumer plans this is frequently on by default.

Delete conversations containing anything sensitive, and consider turning history off entirely for sensitive work.

Assistants that remember facts across conversations build a durable profile of you. Read what it has stored -- it is often more than you expect -- and clear what you do not want kept.

An assistant plugged into your email, files, or calendar can read all of it. Grant the narrowest access that works and remove connections you no longer use.

A unique password and a strong second factor -- ideally a passkey. Your chat history is a concentrated record of your work, your finances, and your health questions.

Go: open a terminal in a folder you can write to — cd ~/Desktop on macOS or Linux, cd %USERPROFILE%\Desktop on Windows.

Do: save this as makedoc.py and run python3 makedoc.py.

"""A document of the kind people paste in when asking for help."""

DOC = """From: sarah.whitfield@northwind-components.co.uk
To: payroll@northwind-components.co.uk
Subject: Q3 contractor payments -- please check before I send

Hi, can you sanity-check these before Friday?

  J. Hart      NI: AB123456C   sort 20-45-11  acct 40118822   GBP 4,120.00
  R. Ferreira  NI: CE987654A   IBAN GB82WEST12345698765432   GBP 2,980.00

The payment portal creds are still the shared ones:
  user: payroll_admin
  pass: Northwind!2026

API token for the accounting sync (do not rotate yet):
  sk_live_9f3a2b7c1d8e4056a1b2c3d4e5f60718

My mobile is +44 7700 900412 if anything looks wrong.
Also the client's DOB for the KYC form is 1984-06-17.
"""

open("draft.txt", "w").write(DOC)
print("wrote draft.txt --", len(DOC), "characters,", len(DOC.splitlines()), "lines")
print()
print("This is an ordinary work email. Nobody wrote it intending to publish it.")

You should see: a file written, and one sentence worth reading twice:

wrote draft.txt -- 653 characters, 18 lines

This is an ordinary work email. Nobody wrote it intending to publish it.

Read draft.txt before going on. Nothing in it is unusual and nobody in it was careless — it is a routine internal email, and every element in it is there for a good reason. The question its author wants to ask an assistant is about formatting.

If not: PermissionError means the folder is not writable; cd somewhere you own. The character count should be close to 653; small differences from line endings are harmless.

Go: the same folder.

Do: save this as detect.py and run python3 detect.py.

"""Find what you are about to hand over, before you hand it over."""
import re, sys

PATTERNS = [
    ("email address",     r"[\w.+-]+@[\w-]+\.[\w.]+"),
    ("UK NI number",      r"\b[A-CEGHJ-PR-TW-Z]{2}\d{6}[A-D]\b"),
    ("IBAN",              r"\b[A-Z]{2}\d{2}[A-Z0-9]{11,30}\b"),
    ("UK sort code",      r"\b\d{2}-\d{2}-\d{2}\b"),
    ("bank account no.",  r"\bacct\s+(\d{8})\b"),
    ("API key / token",   r"\b(sk|pk|ghp|xoxb)_[A-Za-z0-9_]{16,}\b"),
    ("phone number",      r"\+\d{1,3}\s?\d{4}\s?\d{6}\b"),
    ("date of birth",     r"\b(19|20)\d{2}-\d{2}-\d{2}\b"),
    ("password line",     r"(?im)^\s*pass(word)?\s*:\s*\S+"),
]

text = open(sys.argv[1] if len(sys.argv) > 1 else "draft.txt", encoding="utf-8").read()

total = 0
for label, pattern in PATTERNS:
    hits = re.findall(pattern, text)
    if hits:
        total += len(hits)
        print("%-18s %d found" % (label, len(hits)))

print()
print("distinct kinds of sensitive data :", sum(1 for l, p in PATTERNS if re.search(p, text)))
print("individual items                 :", total)
print()
print("Every one of these was going to be pasted into a chat box in order to")
print("ask a question about the formatting.")

You should see: nine kinds of sensitive data in eighteen lines:

email address      2 found
UK NI number       2 found
IBAN               1 found
UK sort code       1 found
bank account no.   1 found
API key / token    1 found
phone number       1 found
date of birth      1 found
password line      1 found

distinct kinds of sensitive data : 9
individual items                 : 11

Every one of these was going to be pasted into a chat box in order to
ask a question about the formatting.

Two of these patterns were wrong when this was first written, and both failures are instructive. The API-key pattern originally read [A-Za-z0-9]{16,}, which cannot match sk_live_9f3a... because of the underscore in the middle — so the single most dangerous item in the document was reported as absent. And the national-insurance pattern excludes the letter Q, correctly, because it is not valid in a real one; the first draft of the document used QQ123456C, the official placeholder, so the detector rightly found nothing.

The general lesson is worth more than either fix: a detector that misses is more dangerous than no detector, because a clean report grants permission. Test yours against something you know is there.

If not: FileNotFoundError: draft.txt means step 1 has not been run in this folder. If API key / token is absent from your output, the character class lost its underscore — it must read [A-Za-z0-9_]{16,}.

Go: the same folder.

Do: save this as redact.py and run python3 redact.py.

"""Replace each item with a placeholder, keeping the shape so the question still makes sense."""
import re

REPLACEMENTS = [
    (r"[\w.+-]+@[\w-]+\.[\w.]+",                        "<EMAIL>"),
    (r"\b[A-CEGHJ-PR-TW-Z]{2}\d{6}[A-D]\b",             "<NI>"),
    (r"\b[A-Z]{2}\d{2}[A-Z0-9]{11,30}\b",               "<IBAN>"),
    (r"\b\d{2}-\d{2}-\d{2}\b",                          "<SORT>"),
    (r"(?<=acct )\d{8}",                                "<ACCT>"),
    (r"\b(sk|pk|ghp|xoxb)_[A-Za-z0-9_]{16,}\b",         "<TOKEN>"),
    (r"\+\d{1,3}\s?\d{4}\s?\d{6}\b",                    "<PHONE>"),
    (r"\b(19|20)\d{2}-\d{2}-\d{2}\b",                   "<DOB>"),
    (r"(?im)^(\s*pass(word)?\s*:\s*)\S+",               r"\1<PASSWORD>"),
]

text = open("draft.txt", encoding="utf-8").read()
for pattern, replacement in REPLACEMENTS:
    text = re.sub(pattern, replacement, text)

open("redacted.txt", "w").write(text)
print(text)
print("-" * 62)
print("This still asks the same question. Nothing that identifies a person,")
print("opens an account or authenticates to anything remains.")

You should see: the same email, still answerable, with the values gone:

From: <EMAIL>
To: <EMAIL>
Subject: Q3 contractor payments -- please check before I send

Hi, can you sanity-check these before Friday?

  J. Hart      NI: <NI>   sort <SORT>  acct <ACCT>   GBP 4,120.00
  R. Ferreira  NI: <NI>   IBAN <IBAN>   GBP 2,980.00

The payment portal creds are still the shared ones:
  user: payroll_admin
  pass: <PASSWORD>

API token for the accounting sync (do not rotate yet):
  <TOKEN>

My mobile is <PHONE> if anything looks wrong.
Also the client's DOB for the KYC form is <DOB>.

--------------------------------------------------------------
This still asks the same question. Nothing that identifies a person,
opens an account or authenticates to anything remains.

The placeholders keep the structure, which is the point: an assistant can still tell you that the second row is missing a sort code, or that the alignment is inconsistent, because those questions are about shape rather than content. Replacing everything with xxxxx would have destroyed the question along with the data.

Where this belongs in a habit: not as a script you run every time, which nobody sustains, but as a two-second pause before pasting anything longer than a paragraph — what else is in this? The script exists to show you what that pause is looking for.

If not: if acct still shows digits, the look-behind (?<=acct ) lost its space — it must match the space after the word. If the password line is unchanged, the (?im) flags were dropped; they make the pattern case-insensitive and anchor it per line.

Go: the same folder.

Do: save this as limits.py and run python3 limits.py.

"""What a pattern-matcher cannot find, and what happens after you paste."""

text = open("redacted.txt", encoding="utf-8").read()

STILL_THERE = [
    ("a person's name",        "J. Hart"),
    ("another person's name",  "R. Ferreira"),
    ("a username",             "payroll_admin"),
    ("the employer",           "Q3 contractor payments"),
    ("two exact amounts",      "4,120.00"),
]

print("%-26s %s" % ("NOT MATCHED BY ANY PATTERN", "STILL IN THE REDACTED TEXT?"))
print("-" * 62)
for label, needle in STILL_THERE:
    print("%-26s %s" % (label, needle in text))

print()
print("A regular expression finds SHAPES. A name has no shape; neither does")
print("a username, a project code, or the fact that these two people are")
print("contractors paid these amounts. Read the redacted version yourself.")
print()

AFTERWARDS = [
    ("kept in your chat history",      "usually yes, until you delete it"),
    ("visible to your employer",       "yes, if it is a work account with logging"),
    ("used to improve the model",      "depends entirely on the setting and the plan"),
    ("included in a shared link",      "yes -- sharing a chat shares everything above it"),
    ("recoverable after you delete it","for a retention period you do not control"),
]
print("%-34s %s" % ("AFTER YOU PRESS SEND", "ANSWER"))
print("-" * 76)
for what, answer in AFTERWARDS:
    print("%-34s %s" % (what, answer))
print()
print("None of these is a reason not to use the tools. All of them are")
print("reasons to decide what goes in BEFORE it goes in, not after.")

You should see: five things still present, and what happens to them next:

NOT MATCHED BY ANY PATTERN STILL IN THE REDACTED TEXT?
--------------------------------------------------------------
a person's name            True
another person's name      True
a username                 True
the employer               True
two exact amounts          True

A regular expression finds SHAPES. A name has no shape; neither does
a username, a project code, or the fact that these two people are
contractors paid these amounts. Read the redacted version yourself.

AFTER YOU PRESS SEND               ANSWER
----------------------------------------------------------------------------
kept in your chat history          usually yes, until you delete it
visible to your employer           yes, if it is a work account with logging
used to improve the model          depends entirely on the setting and the plan
included in a shared link          yes -- sharing a chat shares everything above it
recoverable after you delete it    for a retention period you do not control

None of these is a reason not to use the tools. All of them are
reasons to decide what goes in BEFORE it goes in, not after.

Every item in the first table survived because it has no fixed shape. A regular expression can find something that looks like an IBAN; it cannot find a name, a username, a project code, or the fact that two named contractors are paid particular amounts — which, taken together, is arguably more sensitive than any single number the detector caught.

So automation narrows the problem and never closes it. The last step of any redaction is a human reading the redacted version and asking who would be harmed if it were public.

If not: if any row in the first table prints False, redacted.txt is from an earlier run — re-run step 3. The second table is a fixed list of answers, not a measurement of your own account.

Go: no terminal for this one — this step happens in the assistant you use.

Do: open its settings and find the three controls below. The names differ between products, but every major assistant has some version of each; if one is genuinely absent, that is itself worth knowing before you paste anything into it.

• Training or model improvement. Whether your conversations may be used to train future models. Often on by default on free plans and off by default on business ones.
• History and retention. Whether conversations are stored, and whether you can turn that off for a single conversation. A temporary or incognito chat is the right tool for anything you would not want stored.
• Sharing. What a shared link exposes — in most products, the entire conversation up to that point, including anything you pasted twenty messages earlier and had forgotten about.

You should see: three settings you can name and state the current value of. Write them down; that is the deliverable of this step. If you cannot find one of them, search the product's help for “data controls” or “privacy”.

Then the one rule that survives every change of product and policy: anything you would not put in an email to a stranger does not go into a chat box, regardless of what the settings say. Settings are promises about handling, made by a company, changeable by that company, and irrelevant if the account itself is compromised.

If you use these tools for work, there is a second question worth answering deliberately: does your employer have a policy, and is the account you are using theirs or yours? Pasting client data into a personal account is a different problem from pasting it into a corporate one, and it is usually the one that causes trouble.

If not: if the assistant offers no way to turn off training or history, that is an answer rather than a failure — treat everything you type into it as permanently retained, and redact accordingly using steps 2 and 3.