Practical guide · By Aurelio Avila · October 8, 2026
What not to paste into ChatGPT: a checklist for freelancers and agencies
AI assistants are now part of everyday client work: drafting replies, summarizing briefs, untangling a stubborn bug. The useful question is no longer whether to use them, but what should go into the prompt. Freelancers and agencies handle other people's information, often under a contract that says exactly how it may be shared. This checklist keeps that in mind without slowing you down.
The checklist
1. Client and project names. A company name or an internal codename connects everything else in the prompt (a budget, a launch date, a bug) to a real client. Swap them for consistent placeholders such as "Client A" and "Project A" so the answer stays usable. We cover this in detail in Before you paste: protecting client and project names.
2. Contracts, proposals and statements of work. Rates, payment terms, signatures and legal names rarely improve the answer. Paste the structure of the clause you want help with, not the signed document.
3. Credentials and secrets. API keys, passwords, access tokens, connection strings and the contents of .env files are the most common accidental paste, because they travel inside the error logs and config snippets you share while debugging. Remove the value, keep the error.
4. Personal data. Names, email addresses, phone numbers and street addresses of clients, their customers and their staff. Support ticket exports, CRM extracts and CSV files are full of them. If you need help with the format, a few invented rows do the job.
5. Financial details. Invoice numbers, card numbers, bank details and payment references. Ask about the calculation or the wording, not the account.
6. Unreleased work. Designs, copy and code that a client has not shipped yet. Describe the problem in general terms; share the artifact only if the engagement allows it.
What you can usually share instead
The trick is to separate the task from the identifiers. As our prompt privacy guide puts it: "The task, error and next steps remain. The recipient, project identifier and credential do not."
In practice that means keeping the stack trace but blanking the key, keeping the clause but dropping the parties, keeping the tone of a difficult email but replacing the name of the person it is going to. The AI does not need the real values to help you with the structure.
Make it a habit, not a judgment call
Reading every prompt twice works until you are in a hurry. Redaxa gives you a fixed step instead.
- On the site. Paste the text into the Private prompt check. Visitors get up to 5 free checks per day (shared across their network), with no account or card required. The scan runs on Redaxa's servers over an encrypted connection; the prompt text is discarded and never stored.
- Where you prompt. The Chrome extension checks your message inside ChatGPT, Claude, Gemini, Copilot and Perplexity before it sends. There is also a Windows app with signed auto-updates.
Checks cover four categories: personal data, credentials, financial information and secrets. Findings are specific and readable, and you get a safer version of the prompt to copy. Nothing is changed for you; you decide what to keep.
Client and project names are the one item on this list that generic detection cannot know in advance, which is why Pro (€79.90 a year, €6.66 a month billed yearly) adds protected terms that flag them in every check. Compare plans on the pricing page.
One thing worth saying plainly: no findings means that the enabled checks found nothing. It is not a guarantee that the text is safe, so the checklist above still applies.
FAQ
My AI provider offers settings that limit how prompts are used. Is that enough?
Provider settings vary and change over time, and they do not change what your client contract allows. Check the current terms of the service you use, then treat the contract as the stricter of the two.
What if the client asked me to use AI on their project?
Permission to use a tool is not permission to share everything. Minimize what you paste, keep identifiers out where they add nothing, and keep a record of what the engagement allows.
Does Redaxa itself read my prompts?
The prompt is sent to Redaxa's backend for the scan over an encrypted connection, is not forwarded to a third-party AI service, and is not stored. This is not an offline scanner. Details are in the privacy policy.
Can I try it without signing up?
Yes. The site check gives you up to 5 free checks per day with no account or card.