What not to paste

The window is not private

What you type goes to a company’s servers. It is stored. Depending on the product and your settings, it may be used to improve the service, which can mean human review of samples. Consumer free tiers are the most likely to train on your input; paid business and education accounts usually contract not to. The settings differ by provider and change, so the only reliable move is to look at yours once and know what it says.

That is the background. The foreground is a short list of things that should not go in, whatever the settings say.

The list

Other people’s personal information. A classmate’s draft, a group member’s contact details, a screenshot of a chat, an interview transcript with names in it. You may consent to a service handling your data. You cannot consent on somebody else’s behalf.

Anything from a clinical, legal or social-care placement. Patient details, case notes, safeguarding information, including de-identified accounts that a person could still be recognised from. Medical and nursing students hit this constantly and the answer is always the same: it does not go in. Discuss the clinical question in general terms if you need to. Not the patient.

Research data with human participants. Your ethics approval said where the data would be stored and who would see it. A commercial AI service is almost certainly not on that list. Uploading it can be a genuine research-integrity breach, independent of any AI policy.

Unpublished work that is not yours. A supervisor’s draft paper, a collaborator’s data, a company’s material from a placement. Placements often come with a confidentiality agreement that you signed and have half forgotten.

Credentials and identifiers. API keys, passwords, student ID numbers, bank details, passport scans. Obvious, and it happens weekly, usually inside a pasted config file or a screenshot with a browser tab visible.

Your own most sensitive material. Anything about your health, your finances, your immigration status, an appeal you are making, a disciplinary matter. There is no rule against it and you may decide it is worth it. Decide deliberately, knowing it is stored, rather than by default.

Redaction that actually works

When you need help with something that contains details you should not share, strip it first.

• Replace names with roles: Patient A, the supervisor, Company X.
• Change or remove dates, locations and ages where they are not load-bearing. If the age matters clinically, band it: late 60s.
• Remove anything that is unique in combination. A rare condition plus a small town plus a date identifies somebody even with the name gone. This is the failure most people miss, and it is why simple name removal is not de-identification.
• For code: replace keys with REDACTED, and if a key has ever been pasted anywhere, rotate it. Assume anything pasted is compromised.

Institutional accounts

If your university provides an AI tool, use it for coursework. Two reasons. The contract usually forbids training on your input, and the data usually stays inside an agreement your institution has already assessed. It is also, often, a paid tier for free.

The trade-off is worth knowing: an institutional account may be visible to your institution in ways a personal one is not. Administrators generally cannot read your conversations casually, but logs exist and can be accessed in an investigation. That is not a reason to avoid it. It is a reason not to treat any account, personal or institutional, as a diary.

Checking your settings, once

Spend five minutes doing this properly:

1. Find the data controls or privacy settings. Look for a switch about improving the model with your data. Decide and set it.
2. Look for chat history retention and whether you can delete conversations. Deleting usually removes them from your view; retention for a period on the provider’s side is normal.
3. Look at any memory feature and read what it has stored about you. People are frequently surprised.
4. Check whether your institution provides an account, and what its terms say.

Do it once, per tool, and then stop thinking about it.

The test before you paste

If this ended up in a public archive with my name on it, who would be harmed?

If the answer is nobody (a lecture slide, a textbook page, your own essay draft) paste generously; the grounding lesson is right that supplied text beats remembered text. If the answer is somebody who did not choose this, it does not go in, and that holds regardless of what the settings say, because settings are a promise about handling, not a guarantee about outcomes.