REAL LIFE AI LAB · DIGITAL SAFETY
AI Privacy Checklist Before You Upload Anything
Protect your files • Permissions • Storage • Accounts
Images in this guide are AI-generated editorial illustrations; they do not portray an actual account or upload.
Updated October 11, 2026. An AI assistant can explain public documents, create an outline or help you draft a message. It does not need your driver's license, entire bank statement or a coworker's private contract to do those tasks. The simplest privacy improvement is often to share less, not to search for a setting that promises absolute secrecy.
Quick answer: Before sending any file or text to a consumer AI tool, ask four questions: What private data can I remove? What permissions have I granted? What will the provider store or use? What copies or connections can I clean up afterward? For confidential employer, client, patient or family information, obtain appropriate permission or use an approved environment; changing chat settings alone does not replace consent or legal obligations.
Why an ordinary document can contain more than you expect
A receipt may show a card's last four digits, a home address, loyalty account or purchase history. A résumé may reveal phone numbers and references. A PDF might contain comments, names or metadata you do not see on its first page. An image can reveal faces, private messages in the background or location-related information. A connected mailbox potentially exposes more context than a single question needs.
The Federal Trade Commission advises consumers to think before sharing information online and to review application permissions. Its Heads Up: Stop. Think. Connect. guidance is not AI-specific, but the principles of limiting disclosure and reviewing access apply directly to chatbots and document tools.
Check 1 — remove details the AI does not need
Start with data minimization. If you want an AI to compare the structure of two mobile-phone plans, it may need prices, included data and cancellation terms. It does not need your bank routing number, bill account number, address or email. To draft a polite complaint, you can first replace identifying information with placeholders and add the real details yourself after reviewing the draft locally.
- Identity: Social Security numbers, passport and driver license numbers, dates of birth and exact personal addresses.
- Account access: passwords, recovery codes, authentication codes, credit card numbers and security answers.
- Other people's information: customer records, employee details, children's data, patient information and private family messages.
- Workplace confidential data: proprietary contracts, unreleased financial numbers, unpublished strategies and regulated records.
- Hidden details: document comments, revision histories, image metadata and internal reference numbers.
When possible, create a fresh text-only example with invented names and rounded, fictitious values rather than trying to anonymize a complete original document. Replacing one name may not remove identifying combinations such as a rare job title, town, date and employer. For truly sensitive material, do not rely on partial redaction to make an upload safe.
Redaction example: solve the task without exposing the person
Risky request
My real credit card statement includes account numbers, transactions, home details and merchant information. I want to upload it in full so an AI can tell me how to save money.Lower-disclosure alternative
Help me identify categories to review for a monthly spending plan. This is a fictional example: subscriptions $42, utilities $120, groceries $380, transport $95. Make a three-column checklist with category, question to ask, and where I should verify the charge. Do not claim you reviewed my actual bank data.The lower-disclosure request can still help you build a useful checklist. You can apply the plan to your actual statements offline or within an appropriately approved financial tool. The AI has not seen or validated your private transaction data.
A SAFER WORKFLOW
Use a Redacted or Fictional Example
Share only what the task requires.
Check 2 — review every connected account and permission
Some AI services can be connected to email, calendars, files, cloud storage or third-party tools. A connection may allow retrieval of information far beyond one prompt, subject to the product's permission model. Review what is connected, which account owns it, what actions are possible and how to disconnect it. A consumer connection to personal email does not automatically authorize access to an employer's confidential workspace.
- Open the AI service's app and account settings, and review connected services or permissions.
- Check the connected account identity. Do not confuse a personal login with a work or school account.
- Inspect scopes and capabilities when available: read, search, create, edit, send or delete are not interchangeable.
- Disconnect apps and integrations that are no longer needed, especially broad inbox or drive access.
- Review the third party's own privacy policy, because data sent through an integration may follow its retention and use terms.
Do not conclude that all connectors are unsafe or that all business-tier configurations behave alike. An organization may have a vetted account and appropriate controls. The relevant question is what your provider and organization permit for the exact information and action. The FTC also recommends strong account passwords and multifactor authentication in its personal-information security guidance.
Check 3 — understand the provider's data and retention settings
Privacy controls are not all the same. Chat history is not the same as model training, and deleting a visible conversation is not always the same as deleting an uploaded file stored elsewhere or a third party's copy. Read the provider's terms and privacy notice, especially how data is retained, reviewed, used to improve models and shared with connected services.
Example: ChatGPT consumer data controls
OpenAI's Data Controls FAQ explains that signed-in users can turn off “Improve the model for everyone” in Settings → Data Controls. This controls whether new eligible conversations help improve models; it does not mean the chat cannot be processed to answer your request or retained for legitimate operational and safety purposes. Chat history and other retention controls are separate questions.
OpenAI also describes Temporary Chat behavior. A temporary conversation is not kept in the normal history and is not used for model improvement while temporary, but a copy may be retained for up to 30 days for safety. Some integrated third-party actions have separate policies. Do not present any temporary or training-disabled setting as absolute anonymity.
Example: Google Gemini activity
Google's Gemini Apps Privacy Hub explains how prompts, shared files and connected data may be processed, depending on activity settings and the account. The Gemini Activity Help explains how users can review and delete activity in a personal account. Work or school account settings can be controlled by an administrator. Review the current details before sending content.
Check 4 — know how to remove copies and limit future access
After using a tool, inspect the resulting draft and any stored materials. Delete local temporary files you no longer need, review the AI provider's conversation and file management tools, and disconnect an integration that is not needed. If the provider keeps some operational records, a deletion action may not immediately erase every retained backup or third-party copy. Read the applicable policy and avoid promising total erasure.
- Check whether the service stores attachments separately from chat history.
- Remove unnecessary shared links and make public documents private when appropriate.
- Inspect granted third-party access and revoke unused connections.
- Clear sensitive details from drafts before sending or publishing them.
- Review auto-renewing trials or payment permissions before installing extra apps.
- Secure the AI account with unique credentials and supported multifactor authentication.
THE FOUR SAFETY CHECKS
REMOVE → PERMISSIONS → STORAGE → CLEAN UP
Keep the task useful without giving away more than necessary.
Three situations that deserve extra care
1. Uploading a résumé to improve its wording
A résumé may contain home address, personal telephone number, email, past employers, references and unusual dates. For a writing exercise, use a fictional résumé or a version with identifying details removed. An AI can suggest clearer action verbs without fabricating qualifications. Verify the final résumé reflects real achievements.
For the next step, use our truthful résumé tailoring guide. An AI suggestion is not a recommendation to invent experience, change dates or disclose references without consent.
2. Asking AI to interpret a medical letter
A medical letter may contain diagnoses, test results, insurance details and other sensitive personal health information. Avoid placing such records in an unapproved general-purpose chatbot. For help understanding your own care, talk to your clinician or healthcare provider and use approved patient portals when appropriate. This website is not a substitute for professional medical guidance.
A safer question for a generic AI tutorial is: “What are five questions someone could ask a clinician about an unfamiliar instruction?” No patient's real name, diagnosis, date of birth or clinical record is required.
3. Summarizing an employer's confidential contract
An employer's contract or customer list may be protected by contract, policy and law. Removing a company name does not necessarily make the document sharable. Ask the authorized workplace administrator whether an approved enterprise tool exists; if not, do not upload the material. You can practice on publicly available sample agreements or generic language instead.
A ten-minute AI privacy review for beginners
- Minute 1–2: State the task and ask whether an AI assistant is necessary at all.
- Minute 3–4: Remove or substitute private facts. Check comments and metadata in the file.
- Minute 5–6: Inspect the destination service, account identity, provider policy and connected-app permissions.
- Minute 7–8: Use a fictitious test prompt; verify results before using your real workflow.
- Minute 9–10: Review where the result and input are stored, remove unnecessary copies and record what you should avoid sharing next time.
This is a practical time-boxed checklist, not a tested claim that all privacy risks can be eliminated in ten minutes. Complex workplace or regulated information needs a formal approval process and may not be suitable for a consumer AI service at all.
Printable pre-upload safety checklist
- □ I know the exact question I need the AI to answer.
- □ I have permission to use and share this information.
- □ I removed credentials, identity numbers and unrelated personal data.
- □ I checked for hidden comments, metadata, attachments or other people's details.
- □ I inspected account settings and the service's data-use policy.
- □ I understand relevant connector and app permissions.
- □ I know where uploads, outputs and chats may remain after use.
- □ I will verify consequential statements independently.
- □ I can instead use public or fictional examples if privacy remains uncertain.
Frequently asked questions
Is it safe to upload a file if I turn off AI model training?
Turning off training may affect one specific use of your data, but it does not automatically resolve access permissions, storage, retention, account security or your rights to share the file. Review the full terms and data flow.
Does removing names make a document anonymous?
Not necessarily. Addresses, timestamps, rare events, job titles and combined facts can still identify people. For sensitive records, prefer invented sample data or an approved environment rather than assuming simple redaction is sufficient.
Is deleting the chat the same as deleting an uploaded file?
It depends on the provider and product. Some systems store files or copies separately. Check the actual retention policy and all relevant file and account controls.
Can I use AI for work if my company has not published a policy?
Seek approval from the person or department responsible for the information before sending company data to a consumer AI service. A lack of a written policy is not proof of permission.
Official resources and editorial transparency
- FTC — Stop. Think. Connect. and Share With Care
- FTC — Protect Your Personal Information
- OpenAI — ChatGPT Data Controls FAQ
- OpenAI — Temporary Chats
- Google — Gemini Apps Privacy Hub
- Google — Managing Gemini Activity
Editorial disclosure: This independently prepared education guide is not legal advice, cybersecurity certification, a service privacy audit, or a claim that any individual provider is completely private or unsafe. The screenshots and documents are conceptual illustrations. Data policies vary by plan, location and time, so review your provider and workplace policies directly. Reviewed October 11, 2026.
Leave a Reply