How to Anonymize Data for ChatGPT: Step-by-Step Guide

To anonymize data for ChatGPT, replace every name, email, phone number, account number and amount with a placeholder before you send the prompt, then swap the real values back into the answer on your own computer. Done by hand, that takes minutes per prompt and slips on the first busy day. This guide shows how to do it in seconds with Privacy Mask, a free Chrome extension, from your first custom rule to cleaning a PDF before upload. Every step comes with a short clip recorded in ChatGPT on made-up data.

Key Takeaways

• ChatGPT does not need real identities to write an email, summarise a contract or analyse a table. It needs the task and the structure; placeholders like [NAME_1] and [IBAN_1] keep both.
• Privacy Mask finds 28 kinds of personal and financial data in the ChatGPT input, plus your own terms, and replaces them inside Chrome before the prompt is sent.
• The answer comes back with the same placeholders. Hover to see a value, or copy the whole reply with the real data restored.
• Files get the same treatment: PDFs, scans, photos, Word, Excel and CSV are cleaned locally and only then attached to the chat.
• Temporary Chat and ChatGPT's training settings decide what OpenAI keeps. Masking decides what OpenAI receives in the first place. Use both.

Why anonymize data before ChatGPT

Whatever you paste into ChatGPT leaves your company when you press Enter. On a personal plan, chats can be used to improve OpenAI's models unless you switch that off, and even deleted or temporary chats may be kept for up to 30 days. On ChatGPT Business and Enterprise, training is off by default, but the client's data still sits with a third party your contract with that client may not allow. The full picture, provider by provider, is in what not to share with ChatGPT at work.

Anonymizing the prompt removes the problem at the source. A reply drafted for [NAME_1] about invoice [MONEY_1] is just as useful as one drafted for the real client, and nothing identifying ever reaches the chat.

Before you start

1. Install Privacy Mask from the Chrome Web Store. It works in Chrome and other Chromium browsers.
2. Open chatgpt.com and click the extension icon. The side panel opens next to the chat and stays with that tab.
3. Optional but sensible: start a Temporary Chat in ChatGPT, so the conversation does not appear in your history or train models.

No account is needed. The free plan covers 200 hides and 10 files a week.

Step 1: Add the names only you know are private

Built-in detection knows what an email or an IBAN looks like. It cannot know which project codename is confidential or which company is your client. Add those once as custom rules.

Open Custom rules → Manage rules, type the word or phrase and, if you want, a placeholder key such as COMPANY. From then on, every mention is hidden in any prompt and any file, on every supported AI site; in a prompt it becomes [COMPANY]. Matching ignores letter case. Save each form separately when a client appears in several, such as the full name and an abbreviation.

Custom rules are for labels such as project, client and product names. The extension refuses to save an obvious email, card number or other built-in identifier as a rule, because those are already detected and a saved copy would sit in storage for no reason.

Step 2: Paste the prompt and let Auto mode mask it

With Auto mode on, paste or type your prompt into ChatGPT as usual. When you stop typing, Privacy Mask replaces what it finds right in the input:

Besides names, emails, phones, amounts and IBANs, detection covers addresses, postal codes, dates and times, card and bank account numbers, BIC codes, passports, national IDs, Emirates ID, VAT IDs, licence plates, VINs, IP and MAC addresses, URLs, UUIDs, crypto wallets, PINs, passwords, API keys, JWTs and other secrets.

The extension also adds a short note to the prompt asking the model to keep the placeholders exactly as written. That note is what stops ChatGPT from inventing a name for [NAME_1] or merging two people into one. Nothing is sent automatically: you still press Send yourself.

Step 3: Read the answer with the real values

ChatGPT works only with placeholders, so its answer contains them too. Privacy Mask turns each one into a small pill. Hover over a pill to see the real value; it is shown from your browser, not from the chat.

When the answer is ready to use, press Copy with real data in the side panel. The whole reply goes to your clipboard with every placeholder swapped back, ready to paste into an email, a CRM note or a document.

Placeholders stay the same for the whole conversation. The second person you mention becomes [NAME_2], and a follow-up such as "make the email to [NAME_1] more formal" works exactly as you would expect. For saved chats the mapping is kept in the browser, so the pills still work after a restart, until you press Clear session.

Step 4: Switch to Manual mode when you want to decide first

Some prompts need a judgement call. A date may be the whole point of the question; a company name may be public. Turn Auto mode off and Privacy Mask stops rewriting as you type. Instead, the side panel lists what it found, grouped by type, and nothing changes until you press Hide.

Restore puts the original text back into the input if you change your mind before sending. Manual mode is the better default for legal and HR work, where what counts as identifying depends on the case.

Step 5: Clean a PDF before it goes to the chat

The safest way to give ChatGPT a document is to never upload the original. Open Documents → Open file editor in the side panel and choose the file from your computer. The editor runs inside the extension: no chat, no account and no internet connection are involved.

The left column lists every finding with its type and page, and each occurrence has its own Hidden or Visible switch, so the client's name can be hidden in the address block and kept in the signature if that is what the task needs. Original and Result show the page before and after. For scans and photos, the extension reads the page images with built-in OCR for English, Russian and Spanish.

Rules miss things: a logo, a handwritten note, a company name in an unusual font. Press Hide an area and draw a box over anything that should go. Undo and redo cover both automatic and manual hides.

On export, every page is rendered to an image, the hidden areas are erased from the pixels and the PDF is rebuilt from the clean images. No original text layer, annotation, form field, attachment or metadata survives, which is the difference between real redaction and a black box drawn on top. The trade-off: the result is not searchable, and the editor tells you so.

Step 6: Attach the clean file to ChatGPT

When the result looks right, press Attach to chat and pick the ChatGPT tab. Only the cleaned version is handed over, and it is placed in the input like any other attachment. You still write the question and press Send.

Do not use ChatGPT's own paperclip for the original and plan to clean it afterwards. A file uploaded through the chat reaches OpenAI's servers before any local tool can look at it, and replacing it later does not undo that upload. Clean first, attach second. Attach works with ChatGPT and Claude; for other assistants, download the clean file and upload it yourself.

Step 7: Do the same for spreadsheets, Word files and photos

The file editor accepts PDF, JPG, PNG, DOCX, XLSX, CSV and TSV, and you can select up to 50 files at once. Each file gets its own tab with the same findings list and switches. Spreadsheets and Word files stay editable: names, emails and IBANs inside cells and paragraphs are replaced with placeholders, and document metadata is removed. Photos and scans are read with OCR and redacted in the image.

Download all as ZIP saves every ready result in one go. Each file can be up to 50 MB. If OCR could not read part of a scan, the batch blocks the export of that file instead of skipping it silently; open it alone in the editor and cover the gap by hand.

Step 8: Check the journal

The side panel keeps a journal of every hide: when it happened, on which site or in which editor, and which placeholders were used. The hidden values themselves are never written down. Download CSV exports the journal, which is useful when a manager or a compliance team asks how AI is used with client data.

ChatGPT prompts that work well with placeholders

Placeholders change very little about how you write prompts. A few patterns make the answers better:

• Keep what the task needs. If the question is about the dates, set dates to Visible in Manual mode. The goal is to hide identities, not facts.
• Refer to placeholders by name in follow-ups. ChatGPT treats [NAME_1] as a person and keeps track of who is who.
• Ask for structure. Tables, bullet lists and labelled fields keep placeholders intact better than flowing prose, and they paste back cleanly with Copy with real data.

ChatGPT settings still worth changing

Masking controls what ChatGPT receives. Two settings control what it keeps:

• Temporary Chat. Chats do not appear in your history and are not used to train models. OpenAI may still keep a copy for up to 30 days for safety.
• Improve the model for everyone. In Settings → Data controls, switch it off on a personal account so your chats are not used for training.
• Thumbs up and down. Rating an answer can make the whole conversation available for training, even with the setting off. Skip the ratings in chats with client data.

On ChatGPT Business and Enterprise, training is off by default and your administrator sets retention. None of these settings anonymize anything: the data is still sent. That is the gap Privacy Mask closes.

The same steps in Claude, Gemini and Copilot

Everything above works the same way on Claude, Gemini, Google Search AI Mode, Grok, Microsoft Copilot, DeepSeek and Perplexity. Custom rules, the placeholder mapping and the journal are shared, so a client name added for ChatGPT is also hidden in Claude. Attach to chat is available for ChatGPT and Claude.

What anonymization cannot do

• Context can still identify. "The CFO of the only bank in town" names a person without a single detectable value. Read the prompt once before sending.
• Detection is not perfect. Unusual formats, handwriting and low-quality scans can be missed. That is why Manual mode, Hide an area and the per-occurrence switches exist.
• It is not a company-wide control. An extension depends on people using it. For document pipelines and API calls with enforced policies and logs, Paperwork offers Document Anonymization as a managed service.

For a broader policy view, including what to mask and what to keep visible by team, read how to mask PII before using AI chat at work.

FAQ

Does ChatGPT give worse answers with placeholders?

For most office tasks, no. Writing, summarising, translating and analysing depend on the structure and the request, not on whether the client is called Daniel or [NAME_1]. Answers can get worse when the hidden value is the subject of the question, such as checking whether an address is in a certain district. Keep that value visible in Manual mode.

Does Privacy Mask work with ChatGPT Plus, Business and Enterprise?

Yes. It works on chatgpt.com regardless of the plan, because it changes the text in your browser before ChatGPT receives it.

What happens if a name is not detected?

Hide it by hand: in Manual mode select it before pressing Hide, add it as a custom rule if it will come up again, or in the file editor draw a box over it. Custom rules apply to every later prompt and file.

Can I undo a hide before sending?

Yes. Restore in the side panel puts the original text back into the ChatGPT input. In the file editor, undo and redo cover every automatic and manual hide, and each occurrence can be switched back to Visible.

Where are the real values stored?

In your browser only. For saved chats, the mapping between placeholders and values is kept in local extension storage so replies can still be read after a restart. Clear session deletes it. The journal stores placeholders, not values.

How much does it cost?

The free plan covers 200 hides and 10 files a week without an account. Pro removes both limits for $9 a month or $60 a year and needs a Google sign-in so the plan follows you between computers.

Install Privacy Mask and try it on the next prompt that contains a client's name.

Sources

• OpenAI, Temporary Chat FAQ
• OpenAI, Data Controls FAQ
• OpenAI, Enterprise privacy