Short answer: most of what people worry about is fine, and the thing that actually gets people in trouble isn't on most lists. Here's the breakdown I actually use, tier by tier.
Unless you've turned it off in settings, most consumer AI chat tools may use your conversations to improve their models, and human reviewers can occasionally read flagged conversations. That's the baseline risk for everything you type — not a special risk for "sensitive" topics. It's closer to sending an email through a work account than posting on social media: not public, but not fully private either.
Green — I don't think twice about these
- Drafting an email complaining about a coworker without naming them
- Pasting in a symptom list to understand what a diagnosis term means
- Working through a budget using round numbers ("I make about $70k, rent is $1,800")
- Career or relationship advice framed generally
None of this is traceable to you specifically, and even in a worst-case leak, there's no identifying string attached.
Yellow — I'll do it, but I strip one thing first
My resume, with employer names and dates intact — those aren't sensitive, just personal enough to default to caution before it goes to a stranger's inbox.
My phone number and home address, every time.
A medical question with real detail about symptoms and context.
Any identifying combination — I use "a patient" instead of describing myself, since age + condition + city adds up fast.
Same goes for draft messages to real people: I'll paste an actual awkward text exchange to get help rewording it, but I swap the other person's real name for "my coworker" first — it's their data too, not just mine.
Red — I don't put these in at all, no exceptions
- Social Security or government ID numbers
- Full card numbers, bank account/routing numbers, or passwords
- Anything already under an NDA, even paraphrased ("don't share, but our Q3 revenue is...")
- A real, complete legal name + home address + date of birth in the same conversation — that specific combination is what actually enables identity theft, more than any single piece alone
Before pasting something borderline, I ask: if this exact text leaked publicly tomorrow with my name attached, what's the actual consequence? "Someone learns I'm job hunting" is a shrug. "Someone gets my SSN and mother's maiden name in the same paste" is not. Five seconds, usually enough to decide.
Set the rules once, not every session
If you're building a recurring assistant — a resume helper, a budget coach — the free AI Prompt Builder lets you bake in limits like "never ask for or repeat SSNs, addresses, or full account numbers" once, so you don't have to remember them manually every time.
Try the AI Prompt Builder →Where most advice gets this wrong
A lot of guides say "never share anything personal," which isn't realistic — you lose most of the genuine usefulness of these tools (resume help, budget help, drafting hard conversations) if you follow that literally. The real skill isn't avoidance, it's knowing which specific combinations of details turn a normal question into an identifying or exploitable one, and stripping just those.
Frequently asked questions
Not especially — a resume with your work history is low-risk. The habit worth keeping is stripping your phone number and home address first, since those aren't needed for the AI to help and don't belong pasted into a third-party tool by default.
A full legal name, home address, and date of birth together in one conversation — that specific combination is what enables identity theft, more than any single detail alone.
Only within your employer's rules, and never anything under an NDA even paraphrased. If your workplace has an AI policy, follow it; if it doesn't, ask before pasting client or company data.
Ask: if this exact text leaked publicly tomorrow with my name attached, what's the actual consequence? A shrug means it's fine. Anything worse means strip the sensitive part first.