Most privacy pages tell you what a company promises not to do with your data. This one lists what is taken out of your message before anybody gets the chance — by name, by shape, and including the parts this does not catch.
When you send a message, it does not go straight to a model. It goes through a step that reads it for the kinds of detail that identify a person, replaces each one with a realistic stand-in, and sends the rewritten version onward. The model answers about the stand-ins. On the way back, your real values are put in again, so the reply you read says what you wrote.
The important word is realistic. A blacked-out box tells a model that something was hidden and often stops it answering properly. A stand-in that looks like the thing it replaced — a card number that passes the same checksum, a phone number in the same format, a street address that reads like a street address — lets the answer come back useful.
What is detected
- •Card numbers. Twelve to nineteen digits, spaced or hyphenated or run together — and only when they pass the Luhn checksum every real card satisfies. An order reference of the same length is left alone, which is the difference between a privacy feature and an annoyance.
- •Social Security numbers. The 123-45-6789 shape, and nine digits introduced by a cue such as “SSN” or “social security” — which is how the number is usually written when the dashes are left out.
- •Bank accounts (IBAN). Validated with the same mod-97 check the banking system uses, so a long alphanumeric code that happens to look similar is not touched.
- •Phone numbers, in the shapes people write them: (415) 555-2671, 415-555-2671, +1 415 555 2671. A fourteen-digit order number is not one of those shapes and stays as written.
- •Email addresses, with the address swapped and the surrounding sentence intact.
- •Street addresses and postcodes — UK postcodes, Canadian postal codes, and US ZIPs.
- •Government and account identifiers introduced by a cue: passport, licence, policy, account, reference.
- •Internal hostnames and private IP addresses — machines inside a company network, which name the employer as surely as a letterhead.
- •Your own name, email and phone, taken from your account rather than guessed at, and swapped everywhere they appear.
A card number is replaced by a card number, not by a black box.
What this does not do
Other people’s names are the honest gap. Your own details come from your account and are exact; a name belonging to somebody else has to be recognised in the sentence, and that step is best-effort. It usually works and it can miss. Rather than describe that as protection, the product offers a setting: turn on strict redaction and a message is refused rather than sent when the name check could not finish.
The substitution also happens on a server rather than on your device. That is a real trade and it is stated plainly on the privacy screen rather than buried: what the step removes never reaches a model provider, and the step itself has to read the message to remove it.
What happens when it breaks
It refuses. If the service that performs the substitutions cannot be reached, the message is not sent and you are told why. The alternative — forwarding it unprotected because a component was down — is the one behaviour that would make everything above meaningless, so it is the case the code is written around.
Questions
Does the model see a redacted mess?
No. It sees a coherent message with different specifics. That is why the stand-ins are generated to be plausible: a model that can read the question answers it, and the answer is rewritten with your values before you see it.
Can I stop it hiding a particular word?
Yes. Terms you mark as allowed are sent as written — useful when your own first name is also an ordinary word. The reverse list exists too: words you never want sent, which are replaced even when nothing about their shape would have triggered it.
Is any of this tested?
The detection patterns carry their own test suites, including a set of five thousand ordinary lines — version numbers, timestamps, hex colours, prices, stack traces — that must produce no matches at all. A privacy filter that flags everything is as useless as one that flags nothing, and the second failure is the one nobody notices.
Try Secure AI free
Frontier AI chat — encrypted by default, with your identity stripped before any request reaches the provider.