Keep out anything you would not want a stranger to read: passwords and keys, government and financial account numbers, other people's private details, legal and medical records, and work secrets. Vendors say some chats are reviewed by people and some data is kept for years.
Why the list exists
The vendors themselves point in this direction. Google's Gemini help page asks users not to enter confidential information they would not want a reviewer to see, and says a subset of chats is reviewed by humans and kept up to three years. Anthropic says flagged chats may be kept up to 2 years, feedback data for 5 years, and that consumer chats may be used for training if you allow it.
The list
Never paste:
- Passwords, recovery codes, API keys, private keys, session tokens.
- Government ID, tax, bank, card and insurance numbers.
- Full medical records, test results and diagnoses with names.
- Legal documents tied to a dispute. See our post on legal matters and privilege.
- Another person's private message, photo or health information.
- Your employer's source code, customer data, contracts, plans or unreleased numbers, unless your employer approved the tool.
- Anything covered by an NDA.
- Children's names, schools and routines.
Safer ways to get the same help
Replace details with placeholders. "Client A" and "Account 1234" give the model what it needs. Remove the real values yourself before you copy text in.
Ask the general question. "How do I appeal an insurance claim denial" gets you most of the way without a policy number.
Describe the shape of a document, not the document. Paste a redacted paragraph instead of the whole file.
Use a temporary or incognito chat for the sensitive ones, and keep the training setting off.
If you already pasted something
Treat a pasted secret as exposed. Rotate keys and passwords, and ask your bank or provider what to do for account numbers. Delete the chat, unshare any link, and check feedback was not sent. Deleting helps with storage, but it cannot unsay what you typed.
For families
Agree three rules: no passwords, no other people's details, no school or health records. Write them on the fridge if needed, and revisit when a child starts using a chat tool.
Quick check
Is it fine to paste work data if I delete the chat afterward?
Not by default. Check your employer's rules first. Deleting limits storage but does not undo the disclosure.
Do vendors really read chats?
Google says a subset is reviewed by humans. Anthropic says human review is a narrow exception tied to flagged content, for the commercial offerings its legal article covers.
Sources
- Gemini Apps Privacy Hub (Gemini Apps Help)
- How long do you store my data? (Anthropic Privacy Center)
- Using Claude for Legal Work (Claude Help Center)
Last reviewed: 19 October 2026.
