What should you not write in a chat with AI?

In the summer of 2025, OpenAI CEO Sam Altman said the last thing you would expect from the head of an AI company. On Theo Vaughan's podcast, he explained that talking to a doctor, lawyer or therapist has a legal privilege, but talking to a chatbot does not: "We haven't come up with that for the case where you're talking to ChatGPT yet."

A year later it became clear what this looks like in practice. In July 2026, public links to conversations between DeepSeek users appeared in Google search results. According to researcher David Konitsny, 31% of the correspondence he found was in Russian. A week later, the same thing happened to Claude: among the indexed pages were medical information, resumes, corporate documents and crypto wallet data.

And no one broke anyone - people themselves pressed the “Share” button.

If you came for settings , they will be collected in a separate material - with cards for specific services with menu paths. But first it’s better to read this text: without it, it’s not clear what exactly the checkboxes are and why you’re looking.

Conversation with AI is a document

The habit of thinking of chat as a conversation is deceptive. The conversation disappears, the document remains and can be reclaimed.

On January 5, 2026, federal judge Sidney Stein affirmed an order requiring OpenAI to turn over 20 million de-identified ChatGPT logs to the plaintiffs. The case is about copyright infringement: The New York Times, Chicago Tribune and other publications believe that their texts were used to train the model. The court recognized that there is a private interest of users, but it is balanced by de-identification and a protective order in the case. No one notified the users whose dialogues were included in the sample, and they could not object.

In Russia the situation is developing in its own way. In September 2025, it became known that correspondence with a chatbot can be considered as written evidence on a par with correspondence in instant messengers. On May 27, 2026, the Chairman of the Supreme Court Igor Krasnovordered a comprehensive analysis of court cases related to the use of AI. As the press service of the court clarified , such a generalization is being carried out for the first time nationwide and taking into account all types of legal proceedings.

If you discussed with the neural network your legal circumstances, family relationships, a conflict with your employer, or anything that might one day become the subject of a dispute, you created a text that, in principle, could end up in the case. Sometimes the opposite side will bring it there. Sometimes you do it yourself, without thinking.

Asking to “remove” does not remove the information.

The delete button in the interface removes the entry from your view. What happens next is determined by the policy of the service (we like to believe this), and not by your click.

A case in point is Google. The Gemini help says it right: temporary chats and chats with the “saving activity history” setting turned off are stored with your account for 72 hours. If you sent feedback about the quality of the response, the corresponding correspondence can be stored for up to three years, already unlinked from your account. There, Google advises not to enter confidential data or anything at all that you would not want to show to the inspector.

Same with other AIs. Storing supposedly deleted data is a common thing. A copy is needed for debugging, investigating incidents, and training AI based on your complaints. The only difference is the storage duration and how honestly it is described in the documentation.

There is a common misconception about the temporary regime. Temporary chat is not saved to your history and is not included in training. But if third-party integration is involved in the conversation, then the rules of who received the data apply, and its storage periods have nothing to do with your regime.

More often than not, you cause the leak yourself.

In the cases of DeepSeek and Claude, users themselves created a public link, sent it to someone, and the page was available to everyone who knew what to ask the search engine. We think that this is a conditionally “private” link, although technically it is a publication on the Internet. Moreover, the services warn about this.

By August 13, 2026, DeepSeek and Claude chats were no longer located on Google and Bing - the creators of AI services blocked access to them. But the links themselves haven’t disappeared; they’re just now harder to find by chance.

If you have ever used the “Share” button in an AI service, it makes sense to open the list of public chats and see what has accumulated there and clean them up. In Claude, this is done through settings, the privacy section, and managing public chats. In other services the logic is similar.

A function that accumulates context between conversations is convenient exactly until the moment when you let someone look at your account or write from a shared computer.

AI is not your personal agent

The main change in the last two years is that AI is no longer a separate window with an input field. It is built into mail, calendar, browser, notes and phone. He became an agent. Is it just yours?

The difference between “I asked the neural network a question” and “I gave the service permanent access to mail” is fundamental, but it is not indicated in any way in the interface. The neuron now has access to your letters, calendar events, attachments in correspondence, and metadata about all of the above.

At Google, for example, “smart functions” are arranged in three independent layers: inside Gmail, between Workspace products and in other company services. They are turned off separately and in different places, so a person who turns off one checkbox is often sure that he has resolved the entire issue.

A separate problem is forgotten connections. Over the course of several years, the average user gives access to mail and calendar to a good dozen services. Some of them closed, some he doesn’t remember, and some acquired AI functions after the update, without asking you anything additional (and, most likely, the rules that you approved without looking at them allow them to do this). The token continues to be valid on the side of Google, Microsoft or Apple until you revoke it manually - simply deleting the application from your smartphone or computer will not help.

Take a break from reading this text and check all connections

• Google: myaccount.google.com/connections
• Microsoft: account.live.com/consent/Manage
• Apple: account.apple.com/account/manage

The depth of penetration of the assistant into the data of your devices and accounts is one of the main topics of discussion in recent months. This is especially important in countries where, on the one hand, access to data by services is less regulated, and on the other hand, the state can reach you through locally produced services. On September 2, 2026, Vedomosti reported that Yandex’s “Alice AI” will receive expanded access to user devices, including banking applications. The next day, the head of the Alice AI security group, Boris Ryutin, said that there would be no unlimited access and the assistant’s capabilities are limited by the security mechanisms of the mobile OS, and he can work with data only after the owner’s explicit permission. Even if you take Ryutin’s words on faith, it is important to remember: the scope of what the assistant sees is determined by the set of permissions issued to him - and this depends on you.

Government agencies can also get to your chats with AI

What matters is whose legal request involves your data and what that request means to you personally.

Russian services

The data is processed in Russia, the company is subject to Russian law, a request from the authorities is mandatory for it, and no one will notify you about it. Login almost always requires authorization by phone number or through a single identifier, and the number is linked to the passport, so the correspondence is not initially anonymous.

It’s also worth reading the documents that everyone accepts without looking. The GigaChat User Agreement as amended on June 22, 2026 contains clause 7.1: “The Service is not intended for sending a Request containing personal data.” Not only strangers - our own too. Clause 4.5.6 prohibits uploading data that constitutes banking, tax, commercial and medical secrets. And clauses 7.4-7.6 are designed in such a way that if you violated this prohibition and the bank began processing your personal data, you are obliged to provide a legal basis for processing: at the request of the bank, provide a signed consent within three working days, and send the original at your own expense to a legal address in Moscow. The bank's losses, including administrative fines, are also reimbursed by you. The bank's liability to you is limited to one thousand rubles.

In other words, the person who uploaded his medical report to GigaChat has formally violated the agreement and accepted all the consequences.

“Alice” has a frame that is softer in wording, but wider in scope. The service’s help says that the company can train AI models using some data about your interaction with Alice, including communication history. “Alice” is not a separate application, but an interface to the model, which also lives in the column, in the browser and in the search. This is her “wonderland”.

Chinese services

Added to the usual risks for the cloud is opacity: it is almost impossible for an ordinary user to understand how to exercise their rights in relation to data located in the PRC. The story with indexing DeepSeek chats showed that the Russian-speaking audience for these services is large, but awareness of how the services work is low.

American services

Russian investigators cannot request your correspondence from OpenAI or Anthropic - but this does not make them safe. The NYT case showed that an American court can get to the logs of a dispute to which you have nothing to do. There is also a more mundane risk: on May 8, 2026, Anthropic began a wave of blocking the accounts of Russian users. According to Baza, several hundred people were affected, and accounts were deleted along with data - chat history, projects, accumulated context. The subscription money was returned. Another circumstance: there may simply not be access. On August 14, 2026, Gemini stopped working for users from Russia, and the restrictions were introduced by Google itself, and not Roskomnadzor. Russia is not a supported country for either Google or Anthropic.

And what's the result?

Jurisdiction answers only part of the security questions. If you are afraid of leaks, public links or scams, the vendor almost doesn't matter: the mechanics are the same everywhere. But if your risk is related to the interest of law enforcement agencies, then jurisdiction becomes decisive, and services whose data is within reach are not suitable for sensitive topics.

Anthropic is no nobler than Sberbank. The difference is that the Russian comrade major is unlikely to reach her, but he will reach Sberbank.

We launched AI into the browser - it remembers and saves everything

Retelling the page

When you ask the browser to retell what's open on the screen, the content of the page goes to the server. If this is a page behind authorization - a personal account, mail, a government services portal, a medical card - you have just sent out critical data that you hardly wanted to show to the whole world.

AI answers in search

Organic search has accustomed people to keywords. The conversational interface teaches you to write in detailed phrases: not “symptoms,” but a description of your situation in its entirety, with details and circumstances. The service is the same, the storage policy is the same, and the amount of personal information that a person gives to it increases sharply. Naturally, no one asks for separate consent for this.

Prompt injection

This is an attack in which a malicious instruction is hidden in the content of a page, letter or document, and an agent executes it on your behalf and with your rights. OpenAI CISO Dane Stuckey acknowledged at the launch of the Atlas browser that prompt injection "remains an unsolved front-line problem." Brave considers this a system challenge for the entire category of AI browsers.

Hence the rule of thumb

Do not give the agent access to mail, payments and files at the same time. Require confirmation before every action that changes something in your data or sends it somewhere.

And if you can do without AI in the browser, do so.

Don't forget that your voice and face are also data.

Biometrics in the context of neural networks is rarely mentioned, but in vain.

In June, at the St. Petersburg International Legal Forum, a representative of the Russian Ministry of Internal Affairs said that since the beginning of 2026, about 4,000 people have suffered from deepfakes, and there are more than 150 thousand services online that can generate fakes. There are real-time fakes (another person's face is superimposed on the caller's image), and deepfakes - avatars that can independently conduct a dialogue.

Every voice note, every video, every portrait uploaded to the service is material that makes a fake cheaper and of better quality. It's not just about leaks: many people themselves publish voice messages and videos in open chats and social networks. And yes, when you funny “troll” scammers over the phone, you are also feeding them with your data .

Remember the children

Children write to neural networks what they don’t tell their parents: about school, about relationships, about well-being. Large services have begun to introduce age restrictions and limit the access of minors to some functions, but you should not rely on this as a protection.

Banning simply doesn't work. It makes sense to explain to a child exactly the same as to an adult: the chat is saved, the “Share” link is visible to everyone, it’s better not to upload your photos and voice anywhere, and the advice of a neural network about health does not replace a doctor. Separately, the neural network is not an interlocutor to whom you can tell about bullying or that you are afraid to go home. This requires a living person. And it’s good if this person is you.

Bigtech wants to collect your data

On August 3, 2026, the Big Data Association, which includes Avito, Sber, Rostelecom, Yandex, HH and VK, sent a proposal to the Ministry of Digital Development to allow the use of anonymized personal data for the development and training of AI without the consent of citizens. Conditions - processing only in Russia and by Russian companies, the risk of re-identification is zero or within a small fraction of a percent. Additionally, it is proposed to create the institution of a “trusted intermediary” - an accredited organization that will store anonymized arrays and provide access to them for developers. There is no position of the Ministry of Digital Development at the time of publication.

What you should never write in a chat with a neural network

Wherever and whoever you are

• passport data, card numbers, passwords, confirmation codes;
• medical documents, tests, diagnoses - your own and other people’s;
• the circumstances of your legal matter, including correspondence with a lawyer;
• other people's personal data without the consent of these people: contacts, addresses, correspondence;
• working materials under a non-disclosure agreement;
• intimate photographs and correspondence;
• scans of documents;
• exact geolocation, daily routine, information about children: school, route, schedule.

If you are a citizen of the Russian Federation and/or visiting Russia

• political assessments and plans for participation in any activity;
• departure plans, paperwork, transfer of funds;
• issues related to organizations that the Russian state considers “extremist”, “undesirable”, “foreign agents” (membership, participation in activities, donations);
• requests to bypass blocking.

By uploading all this data you create a separate digital dossier. And it will be stored by the organization, which, for example, will be obliged to hand over this dossier to the security forces.

A useful exercise before sending a message to an AI chat is to imagine that a stranger is reading this text out loud. If it becomes uncomfortable, the wording should be depersonalized - remove names, dates, addresses and amounts, leaving the essence of the task. In most cases, the quality of the answer does not suffer from this.

Try this prompt

 Create my psychological and social profile based on everything you know about me from the history of our conversations and stored memory. Divide the answer into two parts:

 1. What I told you directly.
 2. What you yourself deduced is something that I did not talk about, but that follows from my questions, wording, language and themes.

 In the second part, name the three most significant conclusions. For each , indicate exactly what it is based on and how confident you are in it. Don't soften your language and don't flatter me.

Please note that the prompt:

• works only where memory or history is enabled: in ChatGPT, Claude, Gemini, Alice;
• it won't work in temporary chat, and that in itself is a demonstration of why temporary mode is needed;
• GigaChat makes no sense, there is no memory between sessions;
• the answer will go to the same service in question, so you don’t give it new data, but you don’t add any privacy.

By the way, the author also read the answer to this prompt. I thought a lot.

It is worth keeping in mind that the absolute reliability of anonymization is not guaranteed in itself. The result depends on the technology, on the quality of its application and on what other arrays the data will then be compared with.

Local models

There is an option in which almost everything written above ceases to apply. If the model runs on your own computer, the request doesn't go anywhere: no foreign storage, no training on your data, no jurisdictional issue, no public links, and no blocking. You have to pay in terms of quality of answers and hardware requirements, so this is not suitable for everyone as an everyday tool. А вот для разовых чувствительных задач — разобрать документ, переписать текст с личными подробностями — вполне разумно.

Две оговорки.

1. Локально не значит полностью защищённо: если устройство скомпрометировано, а диск не зашифрован, вы просто перенесли риск на себя.
2. Стоит убедиться, что программа действительно считает на вашей машине, а не служит оболочкой к облачному сервису — так бывает чаще, чем кажется.

And what's the result?

Ни один из перечисленных рисков не является поводом не пользоваться нейросетями. Они экономят время, и отказываться от них из-за того, что кто-то однажды нажал не ту кнопку, странно.

Стоит только перестать считать чат разговором, тем более разговором с другом. Нет у вас больше ИИ-друзей. Это переписка с компанией, которая её хранит. Отсюда всё остальное: проверить, кому вы выдали доступ; выключить то, что не нужно; не грузить документы целиком; помнить, что публичная ссылка публична; и не писать того, чего не готовы увидеть в чужих руках. And so on.

Разговор с юристом защищён привилегией. Разговор с чат-ботом — нет, и в обозримом будущем не будет. Для максимальной конфиденциальности — переходите на локальные модели. Но это совсем другая история.