You will be able to name the data that should never be pasted or uploaded, on any account.
Priya, whose budget you followed through module 2, scrolled back through her chat history one evening looking for a prompt she'd written in March. On the way she found a conversation from last year where she'd pasted an entire bank statement to ask about a fee. It had her full name, her address, her account number and three months of balances. Further down was a chat where she'd uploaded a photo of her payslip to ask about CPF deductions, with her NRIC number clearly visible.
Nothing bad had happened. But she had no idea where those files now were, who could see them, or how long they would stay.
Some things should never go into an assistant, on any account, for any reason:
Passwords and PINs, for anything. One-time passwords and verification codes sent by SMS, app or email. Your Singpass ID, password or any Singpass verification step. Full card numbers, card security codes and expiry dates together. Answers to security questions, such as your mother's maiden name or first school.
These are the keys to your accounts. No legitimate money task needs an assistant to see them. Every task in this course works without them, from the budget in module 2 to the loan sheet in module 5. If you ever find yourself about to paste one of these, stop and ask what you're actually trying to do.
A second group of data isn't a key to an account, but it identifies you or exposes your finances, so it shouldn't go in as it is. That covers your NRIC or FIN number, full bank, card, CPF or policy account numbers, and complete statements that show your name, address and balances. Payslips with your employee number, NRIC or bank details fall into it as well, and so do tax notices carrying your tax reference number.
The difference from the never list is that there's a safe version of most of these tasks. You can paste the transactions without the header, the clause without the policy number, the deductions without the NRIC. Lesson 7.2, Redact first, and check your settings, shows how. Module 2 already did it for a bank export.
Other people's financial details belong here too. A parent's insurance policy, a partner's payslip, a sibling's loan statement: they didn't choose to share it with an AI provider. If you're helping family with their money, redact their details just as carefully as your own, and ask them first. And if you handle clients' data at work, as financial advisers and their assistants do, you're bound by your employer's rules and the Personal Data Protection Act, the PDPA, which sets out how organisations in Singapore may collect, use and share personal data. Pasting a client's details into a personal AI account is the kind of thing those rules exist to prevent.
When you paste text or upload a file, it becomes part of your chat history with that provider. It's stored on the provider's systems, linked to your account, for as long as their policy says.
Deleting a chat removes it from your view. Whether it removes it from the provider's systems, and how quickly, depends on the provider and its current privacy policy. Some keep deleted content for a period for safety or legal reasons. Some may use conversations to train future models unless you turn that off. The details vary between providers and change over time, so read the current policy for the assistant you use rather than relying on what anyone, including an assistant, tells you about it.
The practical point is that anything you've uploaded may outlast your decision to remove it. So the two lists earn their place at the moment before you paste, because afterwards they can only tell you what to delete.
There's a second reason to know the never list by heart. Scammers ask for exactly these things. A message that asks you to paste your banking details, a one-time password or your Singpass login into a chat, a form, an app or a "verification assistant" is a scam, whatever it calls itself and however official it looks.
This includes chatbots on fake bank websites and fake customer service accounts on messaging apps. A real bank or government agency won't ask you to type a one-time password into a chat. Scam-proof your money covers how these scams work, including lesson 1.3, The stop-and-check rule for money, codes and apps.
Priya went through her history and deleted every conversation that held data from either list: the full statement, the payslip photo, and a chat where she'd typed her CPF account balance and NRIC to ask about a housing loan. The whole clean-up took about fifteen minutes, and afterwards she noted which provider kept her history and went to read its policy on deleted chats.
Open the assistant you use most and scroll back through your own history with the two lists beside you.
Go through your chat history in the assistant you use most and delete any conversation containing data from the never or avoid lists.
Junxiong-WFG Organisation is an authorised representative of AIA Financial Advisers Private Limited (Reg. No. 201715016G).