Share the task. Spare the details.

First ask: does the task need this detail?

A request to make a message friendlier rarely needs the recipient’s home address. An outline for a school project does not need a child’s full name, school, or daily routine. Give an AI the shape of the problem with invented details whenever you can.

• Keep access secrets out: passwords, one-time codes, recovery codes, API keys, and private links that grant access.
• Keep people out of practice data: names, contact details, ID numbers, precise locations, faces, and voice recordings.
• Keep sensitive records out: customer lists, private conversations, financial or health records, employee information, and school records.

At work, check which tool and data use your organisation approves. The NCSC warns that sending company or customer information to unapproved AI services can reduce an organisation’s control over how that information is handled. Familiarity with a personal app is not workplace approval. [10]

Keep the useful task. Replace the private material.

Our teaching example is a reminder about a borrowed item. No real names, addresses, messages, or account details are needed.

Read the draft yourself. Did it add a fee, change the day, or invent a location? Put any necessary real details into your final message after you finish using the AI.

Check where your information goes.

Before using real work material, find the service’s privacy notice and relevant account settings. Check whether it retains conversations, uses them for model improvement, allows human review, or passes them to connected services. NCSC’s discussion of unapproved AI explains why these controls matter. [10]

• Account and plan: personal, workplace, and developer services can have different arrangements. Check the one you are actually using.
• Connected tools: examine what files, mail, microphone, or camera access you are granting. A request to explain a concept should not need your inbox.
• Sharing and deletion: check who can open a shared conversation and what deletion actually covers. Removing a visible chat is not evidence that every retained copy is gone.

The FTC’s general online-safety guidance also recommends examining app permissions and privacy policies, and warns that other people may retain copies of material you share. [12]

“Open weights” describes access to model parameters; it does not tell you where a particular app sends your prompt. Running a model on your own device is different from using one hosted on a website. Either setup needs its own data-handling check.

Already shared something? Take the next useful step.

Do not paste the secret into another chat to explain the mistake. Stop sending more information and work through the appropriate route below.

1. Password or account access: use the service’s known website to change the exposed password; change it anywhere else it was reused. Turn on multifactor authentication. If you are locked out, use the provider’s account-recovery process. [11]
2. API key or connected app: revoke the exposed key or connection in the provider’s settings and replace it where needed. Ask your administrator for help if it belongs to work. Removing the message alone does not revoke access.
3. Personal or work information: remove public sharing links, use the provider’s deletion or privacy-request process, and tell the responsible adult, employer, or data owner promptly. State what kind of information was involved without repeating it into an unsecured channel.
4. Money or suspected identity misuse: contact your bank or payment provider promptly through its official app or a trusted number. In the US, follow the FTC’s recovery guide and IdentityTheft.gov as appropriate. Elsewhere, use your local fraud-reporting service. [11]

For an unsafe answer or privacy concern on this site, use the contact route in our privacy notice. Describe the problem without sending passwords, private documents, or a child’s personal information.

These actions reduce ongoing exposure; they cannot guarantee that information already disclosed will be erased or that money will be recovered.