Sanitizing documents before you paste them into an AI tool

The quiet scope creep of AI uploads

Pasting a contract into a chatbot, uploading a spreadsheet for analysis, or sharing a screenshot with a vision model all move your file to a third party. What happens next is governed by that provider's data policies — which vary by product, plan, and setting, and which most people have not read. Depending on the service and configuration, uploads may be retained for some period, reviewed for abuse, or used to improve services.

This guide isn't an argument against using AI tools. It's an argument for a habit: send the provider what the task needs, and nothing else. The extra material in a typical file — metadata, hidden sheets, off-topic pages, other people's information — adds no quality to the AI's answer. It's pure downside.

What files carry beyond their visible content

Every format has its own baggage that uploads along with the content you meant to share:

• PDFs: author and organisation metadata, creation timestamps, and software fingerprints in the document properties
• Spreadsheets: hidden and very-hidden sheets, formulas referencing internal data, comments with discussion history, pivot caches holding source data, and identity properties
• Images and screenshots: EXIF metadata including GPS, plus everything visible that isn't your subject — tabs, notifications, credentials
• All formats: information about people who aren't you, which you may have obligations not to disclose

A pre-upload routine

A workable routine, in order:

• Reduce scope first: extract only the pages, sheets, or crop you actually need the AI to see
• Redact visible secrets with solid redaction — names, account numbers, keys — in images and documents
• For spreadsheets, export a values-only clean copy: no formulas, no hidden sheets, no comments, no properties
• Strip metadata from PDFs and images as the final step before upload
• Reopen the cleaned file and look at what you're about to send, as the recipient will see it

Why the cleaning step itself must be local

There's an obvious irony failure available here: uploading your confidential file to a 'file cleaner' website to prepare it for uploading somewhere else. If sanitization is the goal, the sanitizer must not be another disclosure.

Every tool in our routine runs in your browser. The Clean Excel Copy tool rebuilds a values-only workbook and verifies the output contains no formulas, comments, links, or properties. The PDF Metadata tool clears identity fields and rescans its own output. The Image Metadata and Redact Image tools do the same for pictures, with pixel-level verification for redactions. Your file's first journey off your device is the one you actually chose to make — to the AI tool, cleaned.