# What not to paste

A three-tier rule and a two-minute settings check, so nothing you regret goes into a chat.

Start here · v1.1 · draft · https://hayzlabs.com/start/what-not-to-paste/

In short:
- Never paste passwords or access keys, and if you already did, change them now.
- Redact other people's details and health, account and ID numbers first: roles for names, ranges for numbers.
- Check the training setting in the app you use most, and for work material follow your employer's AI policy.

This is step 3 of [Start here](https://hayzlabs.com/start/start-here/). It comes before step 4 because step 4 asks you to write about yourself.

## Three tiers

> [!OUR RULE]
> Sort what you are about to paste into one of three tiers.

| Tier | What goes in it | What to do |
|---|---|---|
| **Never** | Passwords, and the secret codes that let software into your accounts (API keys, private keys, access tokens) | Do not paste them. If you already did, change the key or password now. |
| **Redact first** | Other people's personal information. Health details, financial account numbers and ID numbers. Work material you are not sure you may share | Replace names with roles ("Person A"). Turn exact numbers into ranges. Remove account, ID and policy numbers. Then paste. |
| **Fine** | Public information. Your own non-sensitive text | Paste it. If you prefer, turn training off first (see below). |

For work material, your employer's AI policy decides if one exists. If you cannot find one, use a business tool or a local model (an AI that runs entirely on your own computer), or redact.

Some assistants now invite health records on purpose. ChatGPT Health, open to US adults since July 2026, connects medical records, and OpenAI says Health conversations are not used to train its models ([OpenAI](https://openai.com/index/introducing-chatgpt-health/), vendor). The rule above is still our suggestion for ordinary chats. If you are deciding whether to connect records, see [Connect your medical records to an AI?](https://hayzlabs.com/guides/connect-medical-records-to-ai/).

This page covers what you give an assistant. When the request comes to you instead, such as a caller asking for money, see [AI voice scams: hang up and call back on a number you know](https://hayzlabs.com/guides/hang-up-and-call-back/).

## Check your settings (2 minutes per app)

Training and retention (how long chats are kept) settings differ by app and by plan. Open your app's setting and check it says what you expect (as read from the vendors' pages on 2026-10-11):

- **Claude:** Settings > Privacy, then the "Help Improve our AI models" toggle. Chats are used for training only if you allowed it.
- **ChatGPT:** Settings > Data controls > Improve the model for everyone. Turn it off if you do not want chats used for training.
- **Gemini:** Settings & help > Activity. Gemini trains on chats by default if you are 18 or over, so turn Keep Activity off to stop that.

Retention, temporary chats, memory and the other assistants (Copilot, Grok, Mistral and the rest) are in the quarterly [privacy settings pass](https://hayzlabs.com/setup/privacy-settings-pass/).

## Can I paste this?

Pick what you are about to paste and the tool you are using. The checker (a hands-on tool on this page) takes categories only; you never type the information itself, and nothing you pick leaves your browser.

<!-- WIDGET canIPaste -->

The same rule as a table:

| If it is | And you are using | Verdict |
|---|---|---|
| Secrets | anything | **Don't.** Never paste passwords or keys. |
| Regulated data (such as health, financial or ID records) or other people's personal information | a local model, or a business account your employer approved | **OK** |
| Regulated data or other people's personal information | anything else | **Redact first** |
| Work-internal material, and your employer has an AI policy | anything | **Follow your policy** |
| Work-internal material, no policy found | a business account or a local model | **OK** |
| Work-internal material, no policy found | a consumer account or a temporary chat | **Redact first** |
| Your own non-sensitive text, or public information | anything | **OK** |

Worked example. A spreadsheet of customer names and email addresses, in a consumer account with training on, gives **Redact first**: use an approved business tool, or replace the names and emails with codes such as "Customer 1". The same rule applies to a photo of a receipt or form and to a spreadsheet you hand to an assistant: see [Photos in, data out](https://hayzlabs.com/workflows/photos-in-data-out/) and [Asking questions of your data](https://hayzlabs.com/workflows/asking-questions-of-your-data/).

> [!LIMIT]
> This is not legal advice. Terms differ by plan and region, and they change; check the date on the settings box. Caution has a cost too. The aim is to excerpt and redact so the assistant still gets what it needs to do the job.

## What you keep

A rule card: the three tiers above, copied into your notes. And one setting checked in the app you use most.

If an assistant can act on your email, browser or files, the question moves from what you paste to what it can reach: see [Letting an agent near your email, browser and files](https://hayzlabs.com/guides/agents-near-your-email-and-files/).

## Next

[Step 4: Tell it who you are, once](https://hayzlabs.com/start/tell-it-who-you-are/) (20 to 30 minutes).

## Sources

1. Anthropic. "Updates to Consumer Terms and Privacy Policy." Aug 2025, and Claude privacy page. Vendor page. [Link](https://www.anthropic.com/news/updates-to-our-consumer-terms) · [Link](https://privacy.claude.com/en/articles/10023580-is-my-data-used-for-model-training)
2. OpenAI Help. "Data controls FAQ." Vendor page. [Link](https://help.openai.com/en/articles/7730893-data-controls-faq) · [Link](https://openai.com/enterprise-privacy/)
3. Google. "Gemini Apps Privacy Hub" and the Gemini Apps activity help page. Vendor page. [Link](https://support.google.com/gemini/answer/13594961) · [Link](https://support.google.com/gemini/answer/13278892)