In April 2023, a Samsung semiconductor engineer pasted proprietary source code into ChatGPT to help debug it. A colleague pasted meeting notes. Another uploaded confidential internal data. Within weeks, the leaks had made it back to Samsung’s security team — and Samsung banned ChatGPT across the entire company.
What those engineers forgot — or didn’t know — is that every conversation with ChatGPT is stored on OpenAI’s servers. Not locally, not temporarily, not just for your benefit. On their servers, in their systems, potentially readable by their staff, and possibly used to train the next version of the model.
This is the default. Most people have never changed it.
What OpenAI actually stores
When you start a conversation with ChatGPT, that exchange doesn’t disappear when you close the tab. It’s saved to your account history and kept indefinitely — unless you turn off chat history or delete it manually. Free and Plus users are in this position by default.
The data OpenAI collects extends beyond what you type. The ChatGPT mobile app collects device identifiers, usage analytics, your IP address, approximate location data, and diagnostic information. This is standard for large-scale consumer software, but most people using ChatGPT on their phone don’t register that their location is being approximated at every session.
OpenAI also shares data with third parties. Microsoft is the significant one — it’s both a major investor and the company that provides the Azure compute infrastructure that ChatGPT runs on. Third-party service providers with access to data are also named in OpenAI’s privacy policy, as is law enforcement when legally compelled. OpenAI is a US company governed by US law. If a federal agency requests data under a valid legal order, OpenAI complies.
Human reviewers read conversations
OpenAI employs human reviewers — the company calls them AI trainers — who read real user conversations. This is confirmed in OpenAI’s own privacy policy. The stated purposes are improving model quality and filtering harmful content. Both are legitimate reasons. Neither changes the fact that a person may read something you typed to ChatGPT thinking you were alone.
This isn’t unique to OpenAI. Google, Amazon, Apple, and most major AI companies have used human review at some stage. But it’s worth understanding when you’re using ChatGPT to draft a difficult email to your manager, discuss a health concern, or work through a legal question.
Your chats train future models
Unless you explicitly opt out, your conversations are used to train OpenAI’s future models. The data you generate — your phrasing, your questions, the topics you explore — contributes to the model that other users will interact with.
The opt-out exists and it works. To stop your chats being used for training: Settings > Data Controls > toggle off “Improve the model for everyone.” It takes ten seconds and you lose nothing except the data contribution.
The deletion situation is more complicated. If you delete a conversation from your sidebar, it disappears from your history. But OpenAI retains it for 30 days for “safety purposes” before scheduling it for deletion from production systems. Backup and archival timelines are not fully specified in their public documentation. “Deleted” is not the same as “gone.” (A 2025 court order in the New York Times lawsuit briefly forced OpenAI to preserve deleted chats indefinitely. That order was lifted in late 2025, so the 30-day window applies again as of mid-2026.)
Who actually gets privacy protection
ChatGPT Team and Enterprise plans don’t use conversations for training. This is an explicit commitment for paying business customers.
That protection is not the default for free users. It is not the default for ChatGPT Plus subscribers. If you’re paying $20 a month for Plus, you’re still opted into training data collection unless you’ve manually changed the setting.
This matters because most people who discuss sensitive topics — medical symptoms, financial worries, relationship problems, professional conflicts — are using the free tier or Plus.
The India-specific reality
When you use ChatGPT in India, your conversation leaves India immediately. OpenAI processes data on US-based servers. This is standard for most cloud services, but it carries a specific consequence for Indian users: your data is outside the jurisdiction where you live.
India’s Digital Personal Data Protection Act (DPDPA) is in force, but the cross-border data transfer rules are still being finalised. There is currently no effective mechanism that compels OpenAI to comply with deletion or access requests made under Indian law the way GDPR compels compliance from EU residents.
OpenAI’s privacy policy does technically grant access and deletion rights to all users. You can submit requests at privacy.openai.com. Whether OpenAI processes them within any timeframe specified by Indian law is a separate question — because that law hasn’t yet established the mechanism to enforce it.
EU and UK users have stronger formal protections through GDPR and UK GDPR respectively. Indian users are currently dependent on OpenAI’s goodwill and its own policy commitments.
What to actually change
These are the concrete steps worth doing now, in order of impact.
Turn off training data use. Settings > Data Controls > “Improve the model for everyone” — toggle it off. This stops your conversations from being fed into future model training. It’s the highest-value change.
Turn off chat history. Settings > Data Controls > “Chat history” — toggle it off. With this off, conversations are deleted after 30 days instead of kept indefinitely. You lose the sidebar history as a tradeoff, but you’re no longer accumulating a permanent record.
Delete old conversations you no longer need. If you’ve been using ChatGPT for months or years with default settings, there’s a backlog. Go through your sidebar and delete conversations that contain anything sensitive — health queries, business information, personal details.
For sensitive work, don’t use the consumer product at all. The ChatGPT API has different terms — data sent through the API is not used for training by default. Incognito mode sessions (temporary chats) are auto-deleted after the session ends. For business use cases, ChatGPT Team or Enterprise explicitly excludes conversations from training.
Never paste company confidential data, client information, medical records, or personal identification into any public AI product. The Samsung engineers who leaked source code in 2023 are the clearest illustration of what happens. The tool has no way to understand that what you pasted was sensitive. It treats everything as training material.
ChatGPT is one of several AI services that default your data into training. For the exact opt-out setting at each major company, see our guide to opting out of AI training. And your prompts are only one source of exposure: the same personal details often sit on people-search brokers like Spokeo that resell your name, address, and phone.
What you can do right now
Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist to get in early.