Use AI Help While Keeping Private Information Out of the Prompt

Build the prompt beside the private document

You want help making a difficult message clearer. The obvious move is to paste the message and remove the recipient’s name. But its combination of a rare job, a small location, a particular date and an unusual event may still describe one recognizable person. The private fact survives the missing name.

A better editing exercise starts with a blank document in an approved local text editor. Write the job you want the AI to do: “Produce a respectful request for a revised deadline.” Then build an invented situation that exercises that skill. Keep the private original outside the AI conversation. Use an approved storage location; a document saved in a synchronized folder may also be copied elsewhere.

Every person, organization, value and log fragment below is fictional. These are examples of how to construct a substitute, not excerpts to anonymize or claims about a tested service. You can complete the workshop without submitting anything.

First edit: preserve the communication problem

Consider this invented starting request:

Rewrite my email to Mira, the only overnight equipment supervisor at North Pier Workshop. After her appointment on 14 September, she missed the special inspection and our customer withheld the exact payment of 8,437.20. I want her to explain what happened.

Replacing “Mira” with “[EMPLOYEE]” leaves the role, workplace, appointment, date and distinctive financial detail. Even if nobody could identify the employee, the request would still disclose a sensitive workplace story. Identification risk and confidentiality are separate reasons to remove material.

For a general writing task, replace the situation itself:

Write a respectful message of no more than 100 words from a project coordinator to a colleague. This is a fictional scenario: a routine deliverable is late, and the coordinator needs a revised delivery estimate. Ask what support would help. Do not speculate about personal reasons, assign blame, mention money, or add deadlines or promises. Use [COLLEAGUE] and [DELIVERABLE] as placeholders.

The useful features remain: relationship, audience, tone, desired response and length. The appointment, job rarity and financial dispute contribute nothing necessary to this request. Add the correct deliverable and recipient locally after reviewing the answer. Keep the real identity mapping out of the chat.

This substitute cannot assess whether the actual employee was treated fairly or what a specific contract requires. If that is the real question, the task depends on protected context; a generic rewrite cannot settle it. Use the approved handling process for that material.

NIST’s de-identification guidance distinguishes removing identifiers from transforming quasi-identifiers and cautions that masking tools may be insufficient. The workshop’s approach is narrower: invent a small teaching example rather than certify real records as anonymous.

Second edit: retain the rule and its awkward case

A replacement can also become too vague. “Help with my spreadsheet” removes customer details but gives the model little to work with. Instead, preserve the column structure and business rule while inventing fresh rows.

Before, in a fictional example: “I attached our receivables workbook. Total everything still owed by Harbor Client and tell me why the report is wrong.” That invites disclosure of a whole workbook to answer a smaller question.

Replacement prompt:

I need an Excel formula pattern for this invented table. Column A is Customer, B is Status, and C is Amount. Rows 2–5 are:
Practice A | Unpaid | 40
Practice A | Unpaid | 60
Practice A | Paid   | 25
Practice B | Unpaid | 10

Calculate unpaid amounts for Practice A only. The expected result is 100. Explain the row selection and formula references. For a second case, replace the 60 with an empty cell. Report that the matching data is incomplete; do not silently treat that blank as a confirmed zero. Use only this example.

The expected result follows from 40 + 60 = 100. The paid 25 and the other customer’s 10 must be excluded. In the second case, 40 is a known subtotal, while the complete amount owed is unknown. This tests selection and missing data without revealing real invoices.

Check any suggested formula in an empty practice workbook before adapting it locally. A sum that displays 40 without an incompleteness signal fails the stated second case. Preserve meaningful edge cases—blanks, duplicates, negative values—when they matter to your question, but invent their values independently. Copying actual amounts and shifting every date by one week can preserve a recognizable pattern.

Third edit: describe the failure without its credentials

Diagnostic material needs another kind of editing. An invented request such as “Explain this upload failure: Authorization: Bearer DEMO_NOT_A_REAL_TOKEN; file /Users/fictional-person/Clients/Harbor/settlement.pdf; server returned 401” contains several kinds of unnecessary context, even though this demonstration contains no working secret.

In a real log, inspect authentication headers, cookies, signed links, query parameters, internal hostnames, user paths and request identifiers before copying anything. A token can grant access; a path can disclose a client or matter. Removing the email address alone addresses neither.

Explain the general meaning of an HTTP 401 response during a file upload. This is a fictional example. A desktop client sends an authenticated upload request; the server rejects it before the upload completes. No credential values, filenames or customer details are supplied. Suggest non-destructive checks and identify which additional non-secret facts would distinguish possible causes. Do not ask me to paste tokens or full logs.

This may produce a useful troubleshooting outline, not a diagnosis of your actual system. If more detail is needed, add a verified public error code, relevant client version or authentication method only when permitted. Do not upload the original to ask the same remote service to sanitize it: that sends the material before the sanitization happens.

A clean paragraph can arrive inside a revealing file

For these exercises, submit the invented text without an attachment. Office documents can carry comments, revisions and author properties beyond the visible page. Microsoft documents both these hidden contents and limits of its Document Inspector.

If an authorized task genuinely requires a Word file, the Windows desktop inspection route is File → Save As to create a separate copy, then File → Info → Check for Issues → Inspect Document in that copy. Choose the inspection categories, select Inspect, and review the findings. Preserve the original: removal may not be reversible. Inspection is not a confidentiality certificate, and some concealed objects escape detection. This path is not a Mac or browser instruction; if unavailable, use an approved platform-specific process or return to a fresh text substitute.

Review attachment names and screenshot contents too: tabs, notifications, account avatars and surrounding messages can disclose context. A black rectangle over text is not evidence that the underlying content was removed. Recreating a harmless error message as text avoids needing to sanitize an entire screen.

Account controls answer a separate question

Before optional submission, confirm the approved service, account and feature. Review training use, retention, human access, administrator controls and any third-party handling separately. A paid subscription or “temporary” label does not establish permission to disclose a document.

For personal Gemini on a computer, Google documents Settings & help → Activity; the alternative is its Gemini activity page. Expect to see the personal activity controls. Work or school settings may instead be administered by the organization. Google’s Privacy Hub says temporary chats and chats with Keep Activity off are retained for 72 hours. Training and feedback conditions differ, and safety processing can include human review. Read those conditions before treating a setting as a promise.

For a different product boundary, OpenAI’s API documentation says API data is not used for training unless explicitly opted in, while describing abuse-monitoring logs and feature-specific application storage. Special retention controls require approval and have limitations. Those API terms do not establish the policy for a personal ChatGPT account or another company’s app built on the API.

Read once for disclosure, once for usefulness

Before sending, read the entire outgoing draft for names, identifiers, identifying combinations, secrets and confidential events. Confirm there is no unintended attachment. Check the conversation’s available context: earlier messages, project files, saved personalization and connected apps may expand what the service uses. A new conversation alone does not prove those other channels are absent; consult the exact service’s controls. An instruction to “use only this example” helps define the task but cannot enforce a technical access boundary.

Then read the answer against the job you preserved. Does the email invent a commitment? Does the calculation handle the blank? Does the troubleshooting outline ask for a credential? Reinsert necessary private details only in the approved local document, and do not send that completed version back for polishing.

If you notice an accidental disclosure, stop adding material and follow the organization’s reporting process. Use applicable deletion and access controls without assuming complete recall. Save the useful generic prompt separately so the next request can begin with an already reviewed substitute.