Privacy, memory, and connected data

A chat box can be a data connection

An AI service may store prompts, files, voice, images, feedback, account details, device information, and connected-app data. Some products offer memory or personalisation that carries information into later conversations. Others connect to email, documents, calendars, school systems, or cloud storage. Before using the tool, ask what data is collected, how long it is retained, whether it is used to improve models, who can access it, and how deletion works.

Do not enter passwords, verification codes, private medical or counselling information, intimate images, school records, financial details, legal documents, or another person’s private messages into a general tool. Redact or replace identifying information for ordinary learning examples. Use an approved school or workplace system when policy requires it.

Memory changes future context

A remembered preference can be convenient, but memory can also preserve a mistake, sensitive detail, or information shared during distress. Review saved memories and chat history. Remove items that no longer belong. Understand that deleting a visible conversation may not instantly remove backups or data already included in another system. Product behaviour and policies can change, so re-check after major updates.

Separate profiles for school, work, creator, and personal use when appropriate. Avoid a shared family account for private conversations. Sign out of shared devices and review browser history, downloads, connected apps, and generated files.

Connected tools expand the blast radius

A tool connected to email or files may retrieve more than the user intended. Limit permissions to the smallest folders or actions, prefer read-only access where possible, and remove access when the task ends. Review what an agent can send, delete, purchase, publish, or schedule. Require human confirmation before high-impact actions and keep logs of what was requested and performed.

Treat generated summaries as new copies of the source data. A summary can still expose private facts. Check recipients before sharing and avoid public links by default. For group work, agree whose data may be uploaded and who owns the output.

Use a pause-and-redact workflow

Before submitting, classify the information: public, private, sensitive, or prohibited. Remove names, addresses, account numbers, school identifiers, and unnecessary context. Ask whether the task can be completed locally or with a fictional example. Afterward, review history, memory, connected data, and exported files.

Adults and educators should create clear rules that explain the reason for restrictions and provide approved alternatives. Secret use becomes more likely when policies only say “AI is banned.” A useful policy covers data classes, disclosure, human review, connected apps, retention, and incident reporting.

Release review for privacy memory and connected data should name an owner, evidence location, review date, and the exact condition that would trigger a different decision. That record keeps the lesson tied to operational responsibility rather than leaving it as general advice. Teams should revisit the choice after incidents, major dependency changes, new data classes, or a material increase in scale.

Release review for privacy memory and connected data should name an owner, evidence location, review date, and the exact condition that would trigger a different decision. That record keeps the lesson tied to operational responsibility rather than leaving it as general advice. Teams should revisit the choice after incidents, major dependency changes, new data classes, or a material increase in scale.