Summary: What happens in three seconds: the path your prompt takes

When Aisha clicks Send, her message takes a short trip and the reply comes back, all in about three seconds. The lesson slowed that trip down because what passes too quickly to think about gets treated as if it does not happen at all. Aisha cannot act on a three-second blur. She can act on a path she can name.

The seven steps

1. Keys to chat box. Her fingers press keys. The text appears in her browser’s chat box. Nothing has left her computer yet.
2. Browser to network. She clicks Send. Her browser wraps the text in a network message, hands it to her wireless router, and the message moves onto the public internet.
3. The front door (the CDN). Most large AI tools sit behind a Content Delivery Network: a worldwide network of servers that receives the request, writes a small log of metadata (timestamp, geographic region, message size), and forwards the contents inward.
4. Inside the model service. The CDN passes the message inward to the model service: the vendor software that takes a message, hands it to the model, watches the reply being generated, sends the reply back out. Inside the model service the message is plaintext, the opposite of encrypted.
5. The model thinks. The model reads the message and generates a reply. The reply is built one piece at a time on the vendor’s hardware, not on Aisha’s laptop.
6. The reply comes back. The reply travels the same chain in reverse: model service to CDN to public internet to Aisha’s home network to her browser. Most modern tools stream the reply, sending it one piece at a time as the model generates it.
7. The reply appears. The reply lands in Aisha’s chat box. Her side of the conversation is one piece of data; the vendor’s side (logs, stored conversation, whatever else the policy describes) is another.

Seven steps. Three seconds. One mental picture Aisha can apply before any future paste.

Two words from one vendor’s policy, as a worked example

Every vendor’s privacy policy refers to the user’s messages and the model’s replies under some name; what they call them varies. One major AI provider, in their public privacy policy, uses the words Inputs and Outputs:

You are able to interact with our Services in a variety of formats… (“Prompts” or “Inputs”), which generate responses and actions (“Outputs”) based on your Inputs.

In that vendor’s policy, Inputs are the user’s messages, Outputs are the model’s replies. Other vendors use different vocabulary for the same two things (some say prompts and responses; some say requests and outputs; some bucket both as content). The vocabulary is not standardized; the things it names are. Phase 4 of this track teaches a rubric that normalizes across vendors. This lesson taught the path the policy sits on top of, regardless of which words a given vendor uses to refer to it.

Path versus policy: two different layers

The path is what is structurally possible. The policy is what the vendor commits to doing. Inside the model service, the message is plaintext to the vendor’s systems; that is the structural reality. Whether the vendor stores it, trains on it, retains it for safety review, or deletes it is the policy commitment. Reading either layer as if it were the other leads to either misplaced trust (“the policy says they do not train on it, so it never touches their systems”) or misplaced fear (“their systems see plaintext, so the policy does not matter”). Both layers are real. Both have to be read.

An architectural alternative

The path described in this lesson is the typical shape for a consumer AI tool. It is not the only shape. Some tools are built so that the user’s computer talks directly to an AI provider over an API, with no consumer-facing CDN or vendor middleware in between. Clawless, the desktop app this site’s sister project ships, is one example: the message goes from the user’s computer to the AI provider, and the reply comes back, with no Clawless server in between holding logs of the requests. The point is not that one architecture is better. The point is that the architecture decides which parties along the path see what.

What comes next

Lesson 2.2 walks the same path again, but instead of asking what happens at each step it asks who can see what at each step. The seven-step scaffold from this lesson is the bone structure 2.2 attaches detail to. By the end of 2.2 Aisha will be able to point at any step of the chain and name what is observable there and by whom.

Aisha set her sticky-note timer for two minutes and read a single page of the AI tool’s privacy policy before her first paste. That is the use of the mental picture she just built: not anxiety, not paralysis, but a small concrete next step that makes the policy readable. The path makes the policy make sense.

Three seconds passes. Now Aisha can see the inside of those three seconds.