AI chat is unbelievably useful, which is exactly why it's easy to overshare. You paste a screenshot to troubleshoot a billing issue, you drop in a contract to clean it up, you ask for advice on a situation that's messy and personal. Suddenly your chat log contains more sensitive data than your email inbox.
This guide is a practical what not to share checklist you can use whether you're chatting casually, using ChatGPT for work, or building with AI tools (like we do at QuestStudio).
We'll also cover the new Spotify-Wrapped-style recap feature OpenAI rolled out in late December 2025, called Your Year with ChatGPT, and what it requires from your settings.
The New Wrapped Feature: Your Year with ChatGPT
OpenAI introduced Your Year with ChatGPT as an optional end-of-year recap that summarizes your 2025 usage and high-level conversation themes.
Key Details That Matter:
-
It's rolling out to eligible users (Free/Plus/Pro) in the US, UK, Canada, Australia, New Zealand, and also to consumer users in India on Go/Plus/Pro.
-
To be eligible, you must have Reference saved memories ON and Reference chat history ON, plus meet a minimum activity threshold.
-
It does not use Temporary Chats.
-
Once you open it, it lives like a normal conversation in your chat history; if you delete it, OpenAI says it will be deleted within 30 days.
Why this matters: the recap is fun, but it's powered by ChatGPT referencing your past conversations and memories. If you prefer minimal data retention, you may not want those settings enabled in the first place.
The Core Rule: Assume Anything You Paste Could Be Stored, Reviewed, or Reused
Different apps and plans have different data rules, but the safest baseline is:
Don't put anything in a chatbot that would hurt you if it leaked.
Stanford HAI's privacy researchers explicitly warn that sensitive info shared with major chatbots may be collected and used for training depending on settings and policies, and they recommend opting out where possible.
OpenAI also notes that if you have Improve the model for everyone enabled, they may use your content (including chats and saved memories) to improve models.
10 Things to Never Tell ChatGPT
1) Passwords, One-Time Codes, Recovery Codes, API Keys
If it can log into something, treat it carefully. This includes:
- • passwords, PINs, 2FA codes
- • password reset links
- • API keys (Stripe, AWS, Supabase, Replicate, etc.)
- • private crypto keys / seed phrases
Safer alternative:
Describe the error without the secret, or replace secrets with placeholders like API_KEY=REDACTED.
2) Full Financial Details
Avoid sharing:
- • card numbers, CVVs
- • bank account + routing
- • full statements with account IDs
- • tax forms or payroll info
Safer alternative:
Mask everything except the last 4 digits and remove transaction IDs.
3) Government IDs and Identity Documents
This includes:
- • SSN / national IDs
- • passport, driver's license
- • immigration documents
- • full DOB + address combinations
Safer alternative:
Ask general questions (what documents do I need?) without sharing your actual numbers.
4) Your Home Address + Precise Location Routines
Address by itself is risky; address plus routines is worse:
- • I live at …
- • I'm home alone every day at 2
- • travel dates tied to your real name
Safer alternative:
Use a city-level location, or say a large US city if you just need general advice.
5) Medical Records or Anything You Wouldn't Want in an HR File
Avoid uploading:
- • lab results with identifiers
- • diagnosis paperwork
- • insurance IDs
- • highly sensitive mental health details tied to identity
Safer alternative:
Remove identifiers and ask about ranges, terms, or questions to ask your clinician.
6) Confidential Work Material or Client Data
This is where people get burned the most:
- • internal roadmaps, unreleased financials
- • customer lists, support tickets
- • proprietary codebases or secrets
- • contracts under NDA
Safer alternative:
Summarize the scenario and ask for a template, checklist, or negotiation script.
7) Private Legal Strategy or Documents with Names Attached
Review my case often leads to pasting:
- • police reports
- • court filings
- • settlement drafts
- • names, dates, addresses
Safer alternative:
Ask for general education and draft questions for a licensed attorney.
8) Intimate Personal Content You Might Regret Later
People treat chat like a diary. That's understandable, but be careful with:
- • explicit relationship details
- • confessions involving identifiable people
- • workplace conflict specifics with names
Safer alternative:
Anonymize. Replace names with roles (Person A, Manager B) and remove specific locations.
9) Anything You Didn't Create That You Don't Have Rights to Redistribute
Be cautious with:
- • paid course PDFs
- • copyrighted books/scripts
- • proprietary prompts/brand kits from a client
Safer alternative:
Ask for a summary of a small excerpt you're allowed to share, or describe the concept and ask for an original version.
10) Plans or Instructions for Wrongdoing
Besides being unsafe, it can create real risk. Security providers explicitly warn against sharing or seeking help with illegal activity.
Safer alternative:
Ask about lawful, ethical options or prevention (for example, how do I secure my accounts?).
If You Still Want the "Year with ChatGPT" Recap, Do This Safely
If you decide the recap is worth it, keep your risk low:
-
Turn on Reference saved memories and Reference chat history only if you're comfortable with ChatGPT referencing past chats to build the recap.
-
Review your saved memories and delete anything you don't want retained. OpenAI says you can view and delete saved memories in settings, and you can turn memory off entirely.
-
Consider turning off Improve the model for everyone in Data Controls if you don't want your new chats used to improve models.
-
Use Temporary Chats for anything sensitive going forward (and note the Year recap does not use Temporary Chats).
A Simple "Safe Prompting" Habit That Works
Before you hit enter, ask:
-
Does this contain a secret (password/key)?
-
Does this uniquely identify a person (full name + address, IDs)?
-
Is this confidential for work or a client?
-
Would I be okay if this ended up in a screenshot?
If any answer is no, redact it and ask in a generalized way.