GovAI.pk اردو

How-to Everyone, Introductory, Staying safe

Using AI safely: what never to type into a chatbot

Chatbots are useful, but what you type may be stored, read by staff or used to improve the service. A short list of what to keep out and safer habits.

Last reviewed: . Reviewer: Muhammad Asadullah.

Why it matters

When you type into a chatbot, your words travel to the company that runs it, usually on servers outside Pakistan. Depending on the service and your settings, conversations may be stored, reviewed by staff to check quality or used to improve future versions of the AI. Once something is typed, you cannot be sure where it ends up.

A good rule: do not type anything into a chatbot that you would not be comfortable seeing on a notice board.

Never type

  • Your CNIC number, passport number or other identity numbers
  • Bank or card details: account numbers, card numbers, CVV codes
  • Passwords, PINs or one-time codes (OTPs). No genuine service needs these in a chat
  • Medical reports or test results with your name on them
  • Other people's private information: their phone numbers, addresses, family matters or photos, without their permission
  • Confidential work documents: office files, contracts, customer lists or anything marked confidential. Sharing these can break your employer's rules and the law. This is a common form of data leakage

Safer habits

  • Remove names and numbers first. You can still get help with a letter or a medical question if you write "my father, aged 70" instead of his full name and CNIC.
  • Check the privacy settings. Many chatbots let you turn off chat history or stop your conversations being used for training. Look in the settings menu.
  • Use the real app. Download chatbots only from the official app store or the company's own website. Fake "AI" apps exist to steal data.
  • Be careful with links and files. Do not paste in links or open files from strangers just because a chatbot suggested it.
  • Check the answers. AI can be confidently wrong. See hallucination in our glossary.

A quick test before you press send

Ask yourself three questions:

  1. Does this include anyone's name, number or address?
  2. Would my employer or family be upset if this were shared?
  3. Could a stranger use this to pretend to be me?

If the answer to any of them is yes, edit it out first.