In short: the moment you paste, the text leaves your machine for a server you don’t control, under an account that is tied to you, covered by a policy you probably haven’t read this quarter. That’s not automatically a disaster — but it is a real transfer, and it’s worth knowing which of your messages you’d rather not transfer.
Pasting a difficult message into a chatbot is one of the most common ways people get help with replies. It works, it’s fast, and most of the time nothing bad happens.
This isn’t an article telling you not to. It’s an article about what the paste actually does, because most people picture something vaguer than what really occurs. And the difference between “vaguely somewhere” and “specifically here, under these terms” is the difference between a shrug and a decision.
What actually happens when pasting a chat into a cloud AI?
Four things, in order:
- The text leaves your device. Over an encrypted connection, yes — but to a machine run by someone else, in a country that may not be yours, under a jurisdiction you didn’t choose.
- It sits in someone else’s memory while it’s processed. The model needs the text in order to work on it. That’s not a scandal; it’s how the thing functions. What varies is what happens next.
- It becomes a record associated with an account. Even in a logged-out session, the request is a request: it has a time, an origin, and a body. Signed in, it’s attached to you by name.
- It’s covered by a policy, not by a promise. Retention periods, whether it’s reviewed for abuse, whether it’s used to improve the model — all of that is set by the provider’s terms, and most providers change them sometimes.
The part people miss is number four. They assume the settings they read once are still the settings. Retention windows and training defaults are exactly the kind of thing that gets revised, and the revision is buried in a changelog nobody reads.
So: if you want to know what happens to a specific paste, the honest answer is “go and read what that provider currently says.” Anything more specific than that, from anyone, is either out of date or a guess. We explain our own side of that in where your words actually go.
Where does the difference actually sit?
It isn’t “cloud bad, local good.” It’s three questions: where does the text go, who holds the account, and who can read it.
| Pasting into a cloud chatbot | BreatheReply with your own API key | BreatheReply running a local model | |
|---|---|---|---|
| Where the text goes | The provider’s servers | The provider you chose — your words never reach us | Nowhere. Zero tokens leave your machine |
| Who holds the account | The provider | You | You |
| Can we read it? | — | No. Messages never reach us | No |
| Where the key lives | — | This device | — |
| What decides retention | The provider’s terms, which change | The provider’s terms, which change | Nothing leaves, so nothing is retained |
Two things worth saying plainly about that table.
“Your own API key” is not the same as “private.” It means the text goes where you pointed it, and not to us. It still reaches a model provider, and that provider still has terms. The gain is that you are the one choosing them, and there is no second company in the middle. If you want the text to genuinely not leave the machine, that’s the third column — and it requires running a model locally.
We never store your messages. That’s a statement about us, not about whoever you’ve pointed the key at. Both halves matter, and conflating them is where most privacy marketing goes wrong.
What to check before you paste
Five things, in about two minutes:
- Does this message contain something that isn’t yours? A client’s name, a colleague’s complaint, a salary, a medical detail, a deadline you were told in confidence. If someone else would be harmed by the leak, they didn’t consent to the transfer.
- Is it identifiable? “My manager” is a pattern. “My manager, Priya, in the Dublin office, about the Q3 numbers” is a person.
- Could it be used against someone in a dispute? Performance conversations, HR threads, anything you’d forward to a lawyer later.
- What does the provider currently say about retention? Not what it said when you read it last year.
- Is there an opt-out for training? Many providers have one, and it often isn’t the default. That’s a setting, not a feature request.
None of this means “never paste anything.” It means the cost of checking is about ninety seconds, and the cost of not checking is paid later by someone who may not be you.
When does it matter — and when doesn’t it?
Be honest about the gradient. Not every message deserves this much thought.
Low stakes. Drafting a reply to a newsletter, rewording a product description, untangling your own thinking about a decision you’ll make yourself. Paste away. The text is yours and it reveals nothing.
Medium. Work conversations with names, mildly sensitive context, things you’d be mildly annoyed to see quoted. Worth a moment’s thought — usually fine, sometimes not.
High. Anything involving health, money, legal exposure, someone’s job, or a confidence you were given. Here the ninety seconds clearly pays for itself. Running a local model is the option that changes the answer rather than merely reducing the risk.
The reason we built for the third column isn’t that the first two are reckless. It’s that the moment you’re most likely to reach for help — a message you’re anxious about, late, with someone waiting — is also the moment you’re least likely to do a policy check. The design should make the careful path the easy one.
That’s also why it asks instead of guessing: a tool that invents a deadline or a number makes the message worse, and the fix isn’t a smarter model, it’s one that stops and asks when the fact belongs to you.
And if the reason you’re pasting is that the reply itself is hard to write, that’s a separate problem — the twelve minutes before you hit send is about that part.
If you’d rather the careful path were the default: join the waitlist. BreatheReply is a Windows app that works with your own key or a local model, and never stores your messages.