What not to paste into an AI: using Claude without leaking your data
A simple rule for deciding what you can hand to an AI and what to keep to yourself, how to anonymize data, where to check privacy settings, and how to start today.
Feeding an AI real data is convenient: paste a contract, a client email, or a CRM (customer records system) export and get a clean answer in a minute. The catch is that along with the value, you hand outside the very things you are responsible for: other people's personal data, trade secrets, passwords and access keys. Let's sort out what to keep to yourself and how to work with Claude so the value stays and the sensitive part does not leak.
Why is this your job and not the platform's?
Legally, you are responsible for what you paste into a chat, not the service. If you run a business, your clients' and employees' personal data is on you: you collected it for a specific purpose, and sending it somewhere else without a reason is not allowed. An AI is no different here from any other outside contractor.
The second point is purely practical. Anything you paste can, in theory, be stored somewhere: in your account history, in logs, in the browser cache on a shared computer. That is not a reason to fear the tool and avoid it. It is a reason to build a habit: think for half a second before pasting a chunk of real data.
What should you never paste without thinking?
Here is a short list of things that almost never belong in an AI window in their original form:
- Passwords, access tokens, API (application programming interface) keys, one-time SMS codes. Never show them to any external service, full stop.
- Full passport or ID numbers, card numbers, tax numbers of clients and staff. You almost never need them for analysis.
- Medical, banking, and other sensitive data of people who trusted you with it.
- Trade secrets you are barred from disclosing by a contract with a partner or client. If the contract has a non-disclosure clause, the text of that contract falls under it too.
- Someone else's private code or documents you have no rights to.
Note the phrase original form. Almost any of these tasks can be solved if you anonymize the data first.
How do you decide in a minute whether a text is safe to hand over?
Before pasting a chunk, ask yourself three questions:
- Is there data here that could identify a specific living person? A name plus a phone number, a name plus a diagnosis, a name plus a salary.
- Am I obligated to keep this confidential by contract or by law?
- What happens if this exact text ends up public tomorrow?
If the answer to the first two is yes and the third one makes you wince, do not paste the text as is. But that does not mean the task is impossible. It means the data needs preparation.
How do you anonymize data so the value stays and the risk goes away?
An AI almost always cares about structure and meaning, not the actual surnames. So a simple trick works: replace everything sensitive with placeholder labels, then put the real values back on your side after you get the answer.
An example. You need Claude to read a customer complaint and draft a polite reply. Instead of the real letter, you paste the same thing with swaps: John Smith becomes CLIENT_1, order number 4415-A becomes ORDER_1, the amount stays because on its own it gives nobody away. Claude writes the reply by structure, and you drop the real name and number back in inside your own inbox. The meaning is kept, the personal data never left.
The same trick fits contracts (strip the party names and registration details, keep the gist of the clauses), tables (anonymize the name column, keep the numbers), and correspondence. Five minutes of prep saves you a conversation with a lawyer later.
If anonymizing every time feels like a chore, build a short prompt template with your replacement rules and keep it handy.
Where do you check privacy settings in your account?
Do not rely on memory or on other people's summaries. Go and look yourself. Your Claude account has a privacy and data section: it shows what is turned on for you specifically, whether you can disable history retention and the use of your chats to improve the service. Open Settings, find the data and privacy area, and walk through the toggles deliberately. Settings change over time, so the right habit is to check them yourself rather than trust a year-old article.
One more thing about a work computer. If you are not the only one using the machine, someone else can open your chat history. Log out on shared devices and do not save in the browser what should not sit there.
How do you start today?
You do not need to rebuild every process at once. Do three things. First, commit to the three-question rule above and apply it before every paste of real data. Second, build one prompt template with replacements for the task you do most often. Third, spend five minutes on the privacy settings in your account so you know what is actually turned on.
Working safely with an AI is not about paranoia. It is about a couple of habits that quickly become automatic. Then you get all of Claude's value and do not hand outside the things you would have to answer for later.
If you want to learn Claude step by step on your own tasks, grab our free materials at /guides and take the first free lesson at /try/b0-01-unit.
AGINE Academy is an independent product, not affiliated with Anthropic. Claude belongs to Anthropic.
Questions
It depends on your account type and your settings, so do not rely on hearsay, check it yourself. Open the privacy and data settings in your Claude account and see whether the use of your conversations to improve the service is on. You can usually control it in the same place. The right habit is to verify the settings yourself rather than trust last year's article.
Not in its original form if it contains personal data or a non-disclosure clause. But the task is almost always solvable: strip the names, registration details and numbers, replace them with placeholder labels like CLIENT_1, and put the real values back on your side after the answer. The meaning for the AI is preserved, and the sensitive data never leaves.
Passwords, access tokens and keys, one-time SMS codes, full card and ID numbers, sensitive personal data such as medical or banking records, and someone else's trade secret you are barred from disclosing by contract. None of this should reach any external service in the clear.
Ask three questions. Could this text identify a specific living person? Am I required to keep it confidential by law or contract? What happens if this exact text becomes public tomorrow? If the answers are worrying, anonymize the data first, then work with the AI.