Privacy, Safety & Data Hygiene

The single most useful privacy habit is a mental model, not a setting: assume anything you paste into an AI tool could, in principle, be seen by the provider — whether through logging, review, or training, depending on your specific plan and settings.

This doesn't mean AI companies are reading everything you type; it means you should make decisions as if that were possible, because settings change, mistakes happen, and "probably fine" isn't a great standard for genuinely sensitive information.

Once this becomes automatic, most of the rest of this module follows naturally — you start noticing, in the moment, when something you're about to paste crosses a line, instead of realizing it after the fact.

A concrete, personal never-paste list turns the abstract mental model into a specific, memorable rule. The core items almost everyone should include: passwords and login credentials, full credit card or ID numbers, and other people's private data you don't have clear permission to share.

Writing this list down (literally, on a sticky note or in a notes app) matters more than it sounds like it should — a rule you've consciously written is much easier to recall in the moment than a vague sense that you "probably shouldn't."

The list should be short and personal — five items you can actually remember beats a comprehensive twenty-item policy nobody reads twice.

Using your personal AI account for sensitive work material is one of the most common hygiene lapses, precisely because it's the path of least resistance — you're already logged in, it's right there. Workspace or team-tier plans exist specifically to provide stronger data controls and admin oversight suited to organizational data.

Keeping work and personal accounts genuinely separate isn't just a policy formality — it means the right data controls, retention rules, and organizational visibility actually apply to the right material, rather than sensitive work content sitting inside a personal account with consumer-grade defaults.

A practical rule: if your employer has a workspace or team plan, use it for anything work-related, even if switching accounts is mildly less convenient than staying logged into your personal one.

Most AI tools have a setting, often buried in privacy or data controls, that governs whether your conversations can be used to train future models. This is worth finding and setting deliberately rather than leaving at whatever the default happens to be.

The setting matters because "used for training" is a meaningfully different data-handling promise than "not used for training," and workspace/team plans in particular often make stronger no-training guarantees than free consumer tiers.

This is a five-minute, one-time task per tool — find the setting, decide deliberately, move on. It's exactly the kind of low-effort, high-value hygiene step that's easy to skip and worth not skipping.

Many AI assistants now maintain a persistent memory across conversations — recalling your preferences, past topics, or personal details you've mentioned. This is genuinely useful, but it also means sensitive or stale information can quietly accumulate somewhere you're not actively looking.

A periodic memory audit — actually opening the memory or personalization settings and reading through what's stored — surfaces things worth deleting: an old employer's name, a health question you'd rather not persist, a surprise party you planned two years ago that's still sitting in there.

Treating this like any other digital cleanup task (the way you'd occasionally clear browser history) rather than something to configure once and forget keeps your assistant's memory relevant and appropriately private.

If you handle client or employer data — under an NDA, a confidentiality agreement, or just general professional discretion — pasting that material into an AI tool needs a beat of thought first, not automatic convenience.

The key questions: does your plan's data controls (or lack of training on inputs) actually cover this level of sensitivity? Do you have explicit or implied consent to use AI on this material? Could you anonymize it first — replacing names, amounts, and identifying details — and still get the value you need?

Often a small amount of upfront hygiene (checking the plan tier, or doing a quick find-and-replace before pasting) resolves the tension entirely, letting you get the AI assistance without any actual breach of confidentiality.

AI tools on shared or family devices raise a slightly different set of concerns — not just data privacy, but appropriate content and healthy habits, especially for younger family members. Sensible defaults matter more than strict rules that nobody follows.

This might mean separate accounts or profiles where possible, an open conversation about what's appropriate to ask an AI (and what isn't), and modeling good habits yourself — kids notice how the adults around them use these tools far more than they absorb any explicit lecture.

The goal isn't to lock AI away from younger family members, since these tools will be a normal part of their lives — it's to set defaults that are safe and sensible without requiring constant supervision.