What ChatGPT Stores From Every Conversation

ChatGPT stores far more than the words a user types into the box. Between prompts, uploads, device metadata, memory summaries, and now interaction events recorded from a Mac's operating system, the data footprint of a single conversation extends well past what appears on screen. This piece breaks down what gets collected, where it lives, how long it stays, and which controls actually change that, tier by tier. Most of the controls OpenAI gives users manage risk after the fact, and the one architecture choice that would remove the risk entirely, never transmitting the content in the first place, isn't something a toggle can retroactively provide.

OpenAI's own policy splits collection into two buckets: user-provided data and system-generated data. The first is obvious. Prompts typed, files uploaded, images attached, code pasted into a debugging session, even support emails sent to OpenAI, all fall under data a person deliberately handed over. The second bucket is the one most users underestimate: IP address, device type, operating system, browser fingerprint, approximate location, timestamps on every message, usage statistics, and, for paid accounts, payment details. A 2026 audit of OpenAI's data practices grouped these into seven named categories of personal data. The chat window, which feels like a private, contained exchange between a person and a model, sits on top of the same infrastructure as any large cloud service: servers, logs, backups, and a support team holding access credentials.

Nothing about that back end lives on the user's own machine. Conversations sit on OpenAI's servers, primarily in the United States, and potentially accessible to OpenAI's affiliates, partners, or vendors. When someone opens chatgpt.com and watches their history load, that's a fetch from OpenAI's servers each session. So the moment a message gets sent, it has already left the device, and the real question was never whether it's stored. It's for how long, under which conditions, and who can access it while it sits there.

How retention and deletion work, broken down by tier

Consumer accounts, meaning Free, Plus, and Pro, keep chats indefinitely. No automatic expiration date attaches to a conversation. It sits there until a user manually deletes it, and even then, deletion isn't instant: a deleted chat enters a removal queue with a 30-day processing window before it's actually gone from OpenAI's systems.

Temporary Chats work differently, though not as differently as the name implies. They're not saved to chat history and they're excluded from training. But they can still be retained for up to 30 days for abuse monitoring, and that's the asymmetry people miss: "do not store in history" is a promise about the interface, not a promise about transmission or backend retention.

Enterprise and Edu accounts hand retention control to workspace admins, who set the duration themselves. Deleted conversations there clear OpenAI's systems within 30 days unless a legal requirement forces longer retention, a scenario covered further down. On the API side, standard usage sees inputs and outputs purged from logs after 30 days, unless legal retention requirements apply. Zero Data Retention endpoints skip that step entirely: they never log inputs or outputs in the first place, which is a meaningfully different architecture from "logged, then deleted after 30 days."

Files are their own animal. Anything uploaded during a chat gets saved to the Library, a storage location separate from the conversation itself. Deleting a chat does not touch the file that lived in it. Files have to be deleted independently, through the Library, and even after that happens, internal backups may hold onto a copy for up to 30 additional days.

Notice how many of these numbers land on 30 days. That looks like one unified retention policy, and it isn't. Four separate clocks share that number: the deletion-processing period for a deleted chat, the abuse-monitoring window for Temporary Chats, the log-retention period for standard API calls, and the backup-purge window for Library files. Four different triggers, one recurring figure, and the repetition makes the whole system look more uniform than it actually is.

Model training defaults by tier

On consumer plans, "Improve Model for Everyone" ships turned on. Free, Plus, and Pro users are opted in by default, and disabling it means a manual trip through Settings, then Data Controls, then flipping that specific toggle off. Nobody stumbles into the off position. It has to be deliberate.

Business-facing tiers reverse the default. Enterprise, Healthcare, Edu, Teachers, and API usage after March 1, 2023 all start with training turned off, and an organization has to opt in explicitly if it wants its data used that way. Enterprise customers negotiate contracts, individual users click through a settings menu, or they don't, and OpenAI clearly expects most won't bother.

Fine-tuning at OpenAI can involve human reviewers reading portions of conversations. That matters for anyone assuming "AI training" means only automated systems ever touch the text. A person may read it.

The hard limit that trips people up is the one most users get backward. Opting out of training is not the same switch as deleting a conversation, and treating them as interchangeable is probably the single most common misunderstanding of how ChatGPT handles data. A person can turn off training entirely and still have every past conversation sitting live in their account history, retained indefinitely. Deleting a chat, or even an entire account, removes that data from OpenAI's systems within roughly 30 days, but it does not reach back into a model that already trained on it and extract the influence that content had on the model's weights. OpenAI's own policy language describes previously used training content as de-identified and disassociated from the account, not erased from completed training runs. Disassociation is not deletion, and the distinction is the whole ballgame.

So what does opting out actually buy someone? Protection going forward, nothing more. It stops future conversations from entering the training pipeline and stops the account's identity from being newly linked to any of it. It does nothing about training that already happened. The window to protect a piece of information closes the moment it's transmitted, not when someone later decides to delete it or flip a setting.

Which is the real argument for privacy-by-architecture, separate from any specific opt-out mechanism. A system that never transmits conversation content to a provider's servers in the first place makes the entire opt-out question moot, because there's no pipeline for the data to enter. Opt-out toggles manage risk after transmission. Architecture that skips transmission removes the risk before it exists, and those are not the same category of protection.

The memory system: two layers that persist independently of conversation history

Memory rolled out in two stages. Saved memories launched in April 2024. A year later, in April 2025, OpenAI expanded the system so ChatGPT could reference past chats directly. Two different features, built at two different times, and they behave differently enough that treating them as one thing causes real confusion.

Layer one is Saved Memories: discrete facts ChatGPT stores from something a user said, or explicitly asked it to remember. The model updates this list automatically as conversations happen, and factors those saved facts into future responses by default, unless a user goes in and deletes a specific entry. This layer is at least auditable. A user can open it, read every saved item, and remove what doesn't belong there.

Layer two, Reference Chat History, isn't auditable in the same way. ChatGPT draws on the substance of past conversations to shape new answers, but it doesn't hand the user a readable list of what got pulled from where. The control here is binary: on or off. No entry-by-entry review, no way to see which past conversation informed a given response.

Both layers ship on by default for free-tier users. A short, sparse Saved Memories list can create a false sense of minimal personalization, when Reference Chat History might be actively drawing on months of prior conversations behind the scenes.

Deleting a conversation doesn't touch a memory that conversation generated, because conversations and memories live on entirely separate surfaces inside the product. A user who deletes every chat they've ever had can still have an active memory system built from the content of those chats. Getting to an actual clean slate takes three separate actions: turning off Memory, turning off Reference Chat History, and manually clearing whatever memories already exist. If any one of the three is skipped, a gap remains.

There's a carve-out for regulated environments. In ChatGPT for Healthcare and in ChatGPT Enterprise configured with a Regulated Workspace, improved memory ships disabled by default. Protected health information shouldn't go anywhere near it, full stop.

Dreaming V3: the background synthesis engine that rewrites memory without user prompting

Dreaming is a background process, and it goes a step beyond either memory layer above because it doesn't wait for a user to say or save anything. It reads across years of a person's conversation history and rewrites what ChatGPT remembers about them, on its own schedule, without a prompt triggering it.

OpenAI has framed the purpose of Dreaming as addressing "staleness, correctness, and scalability challenges" at a scale of hundreds of millions of users across multi-year time horizons. That's a genuine engineering problem: a memory system built from years of scattered conversations accumulates outdated facts unless something periodically goes back and reconciles them. Dreaming began rolling out on June 4, 2026, starting with Plus and Pro users in one country.

OpenAI's own example illustrates the mechanism cleanly. A memory that once read "You're going to Singapore in July" gets rewritten, after the trip has passed, to "You went to Singapore in July 2026." Nobody asked ChatGPT to make that edit. The system inferred the trip happened and updated the tense and framing on its own.

OpenAI has published performance figures for the system, though these come from OpenAI's own internal evaluation, with no independent audit or public methodology behind them. By that internal measure, factual recall accuracy moved from 41.5% in 2024 to 82.8% under the 2026 architecture, with preference adherence at 71.3% and time-sensitive accuracy at 75.1%. Those are large, credible-sounding jumps that may well reflect genuine engineering progress. But absent a released methodology or outside reproduction, they read as a vendor's claim about its own system, not an independently verified benchmark. Because the entire pitch for Dreaming rests on the claim that it gets memory right more often than it used to, that gap undermines the pitch itself.

What should worry a careful user more than the numbers is the lack of visibility into how memories get formed. Dreaming operates silently. A user sees the resulting memory after it's rewritten, never the intermediate reasoning, the synthesis step, or the discarded alternatives Dreaming considered along the way. That's categorically different from Saved Memories, where every entry is a line item a person can read and edit. Control over Dreaming exists only at the feature level, on or off. No way to audit what it concluded, no way to reject one synthesized memory while keeping the rest, short of wiping the whole memory system clean.

Computer History: the newest collection surface, recording clicks and keystrokes on macOS

Computer History launched in August 2026, replacing an earlier research preview called Chronicle. The two work differently. Chronicle relied on screenshots, capturing images of the screen at intervals. Computer History instead records interaction events directly, using macOS accessibility features to log clicks, keystrokes, keyboard shortcuts, and app switches as they happen.

OpenAI states the feature doesn't capture screenshots, screen recordings, microphone input, or system audio, and that's a real design distinction from Chronicle's approach. This is the move from monitoring what's typed into a chat box to monitoring what happens across an entire operating system.

The data flow runs in stages. Interaction events are stored temporarily, right on the user's Mac. That raw event stream is processed locally to generate memory summaries and suggested workflows. The raw temporary files clear after 48 hours. But the generated memory files, the summaries built from that raw data, stay on the user's own filesystem indefinitely, until the user deletes or clears them.

Those generated memory files sit as plain, unencrypted Markdown. Any other program running under the same macOS user account can potentially read them. That's a local security exposure stacked on top of the transmission risk, and unlike almost everything else in this piece, it sits entirely on the user's machine rather than on OpenAI's servers.

Computer History is now available in the EEA, Switzerland, and the UK, but only for Pro, Business, and Enterprise users. That geographic split maps roughly onto stricter data protection regimes in those regions, though what conditions actually differ in how the feature runs there versus elsewhere isn't specified.

The significance here is straightforward, and probably underappreciated given how recently the feature shipped. Computer History moves the collection boundary. It used to stop at what you type into ChatGPT. Now it extends to what you do on your computer while ChatGPT happens to be running in the background, which is a meaningfully larger perimeter than most users have registered yet.

How the NYT v. OpenAI legal hold changed retention for millions of users

In May 2025, a preservation order issued in the New York Times' copyright litigation against OpenAI required the company to retain consumer ChatGPT and API content indefinitely, effective May 13, 2025, until the court said otherwise. That order overrode the standard 30-day deletion policy for every account it covered. Data a user thought had been deleted, or expected to clear within the usual window, instead sat preserved under a court order the user had no way of knowing existed.

The order applied broadly: Free, Plus, Pro, and Team consumer accounts, plus standard API customers without a Zero Data Retention agreement in place. It excluded API customers who did have ZDR agreements, along with ChatGPT Enterprise accounts. Conversations originating from a set of regions with their own data protection framework were excluded too, likely reflecting the different rules those regions operate under.

The obligations under that order concluded on September 26, 2025. OpenAI's own statement, updated October 22, 2025, confirms a return to standard retention practices going forward. But concluded doesn't mean everything from that window vanished. A limited set of data from April through September 2025 remains under legal hold, restricted to authorized personnel inside OpenAI. It hasn't been handed over to the New York Times or to the court itself, at least based on what's been disclosed publicly.

On January 5, 2026, in the consolidated multidistrict litigation captioned In re: OpenAI, Inc. Copyright Infringement Litigation, the court affirmed an order requiring OpenAI to produce a de-identifie... On January 5, 2026, in the consolidated multidistrict litigation captioned In re: OpenAI, Inc. Copyright Infringement Litigation, the court affirmed an order requiring OpenAI to produce a de-identified sample of 20 million ChatGPT logs, over OpenAI's own privacy objections. That's a significant volume of logs changing hands in a legal proceeding, even stripped of identifying information.

"Deleted" turns out to be a promise made inside the current legal and contractual environment, not an absolute guarantee. Litigation involving a company can retroactively extend retention obligations for accounts that had no visible connection to the underlying dispute. A person using ChatGPT for ordinary, unrelated purposes in mid-2025 had no way to anticipate that a copyright suit filed by a newspaper would freeze their deletion timeline for months.

What users can control, and where the controls stop

Some controls genuinely work as described. A user can opt out of model training through Settings, Data Controls, and the "Improve Model for Everyone" toggle. Individual conversations can be deleted, processing within roughly 30 days. Temporary Chat exists for sessions someone doesn't want in history, though it's still transmitted and held for up to 30 days for abuse monitoring, so it isn't equivalent to never sending the data. Saved memories can be deleted one at a time or cleared completely. Memory and Reference Chat History switch off independently of each other. Library files delete separately from the chats they came from. Computer History can be disabled, or simply never installed. Conversation data can be exported before deletion, preserving a personal copy outside OpenAI's systems.

That's a real, functional set of levers. Now look at where each one stops, because the stopping points are the actual story here.

Opting out of training doesn't touch content a model already trained on. That influence stays baked into the model's weights no matter what a settings toggle says today. Deleting a chat doesn't delete the memory that chat produced, since memories live on a separate surface and need their own deletion step. Reference Chat History can't be audited entry by entry, only switched on or off as a block. Dreaming synthesizes across years of history in the background, with no interface for reviewing or contesting its intermediate conclusions short of wiping memory clean. Legal holds, as the New York Times litigation showed, can override a user's own deletion request with zero advance notice. Computer History's generated memory files sit unencrypted on the local filesystem, exposed to any other process running under the same user account. And consumer plans carry no enterprise-grade data-processing agreement, so none of the contractual protections available to Enterprise customers extend to someone on Free, Plus, or Pro.

The architecture underneath ChatGPT was built to retain information and learn from it, and the privacy controls got layered on top of that foundation afterward, not designed into it from the start. That's not a criticism unique to OpenAI; it's roughly how most large consumer software gets built, features first, controls in response to demand or regulation. It's roughly how most large consumer software gets built, features first, controls in response to demand or regulation. But it does mean the burden of limiting what gets collected sits with the user, who has to actively find and use each control, rather than with a system built from the outset to collect less by default.

For anyone whose work touches sensitive material, legal filings, medical records, proprietary source code, unreleased financial data, the honest read is that these controls manage risk at the margins. They reduce exposure. They don't eliminate it, and conflating the two is the mistake to avoid most. An architecture that never transmits conversation content to a provider's servers in the first place sidesteps the entire question: no training pipeline to opt out of, no chat log sitting on a server waiting for a legal hold, no memory synthesis running silently in the background, because the content never left the user's control to begin with. That's a different category of guarantee than a toggle switch, and understanding the difference matters before deciding what belongs in a chat window.