On this page
An assistant can answer one question without knowing much about the person asking it. An assistant that remembers projects, reads email, connects to work applications, and acts on a person's behalf works with a different quantity of information. Some arrives in prompts. Some comes from files, connected accounts, activity records, and previous conversations. Some becomes context that the assistant uses again.
OpenAI's published documents describe these flows in considerable detail. They also describe different kinds of control. Stopping model training is not the same as deleting a conversation. Disconnecting a service is not the same as removing what an agent learned from it. Turning off memory does not erase the original material. Those distinctions matter as ChatGPT moves from answering a request toward keeping up with a person's work.
This analysis uses OpenAI's Privacy Policy (updated September 10, 2026), Terms of Use (effective January 1, 2026), and Service Terms (updated September 29, 2026), with the product-specific documents linked below. All were reviewed October 9, 2026. Readers in the EEA, UK, and Switzerland have a separate Europe privacy policy (updated August 24, 2026) and Europe Terms of Use (updated January 16, 2026); business customers have separate agreements. Provisions can differ by region: for example, the US and European policies group certain disclosure categories differently. Account behavior depends on the applicable region, plan and settings.
The record begins before memory
The Privacy Policy, section 1, includes account details and payment history, prompts, uploaded documents, images, audio and video, and "data from connected services". It also names contact information users choose to connect, communications with OpenAI, and information from other sources.
Some information arrives without being typed into a conversation. The policy covers IP address, browser and device characteristics, interaction logs, features used, actions taken, time zone, and coarse location inferred from network information. A person may choose to supply precise device location. For Free and Go accounts, the document describes data about ads viewed or engaged with; it also addresses information from advertisers and data partners. The scope goes beyond what a person remembers telling the model.
Collection does not mean every item is used for every purpose. The policy says information supports running the service, personalization, research and development, security, legal compliance, communication, and—in specified circumstances—marketing and advertising. Those purposes should be read alongside the specific controls for training and personalization.
The Terms of Use, Content section, separates ownership from processing. It says "you (a) retain your ownership rights in Input" and assigns OpenAI's rights in eligible output to the user. The same section says "We may use Content to provide, maintain, develop, and improve our Services". Owning a prompt or answer does not mean it stays only on the user's device, or that the provider cannot process it.
Four places information can persist
For ordinary conversations, the chat and file retention guidance says regular and archived chats remain in the account until deletion or an applicable workspace rule removes them. Archiving changes where a chat appears, not its retention. Deleting a chat removes it from the account view immediately and schedules permanent removal within 30 days, except where information was already de-identified and detached from the account or security and legal obligations require longer retention. The Privacy Policy's retention section likewise says deletion normally occurs "within 30 days" and specifies exceptions, including fraud, compliance, payment records, and audit records of deletion requests.
Temporary Chat has another rule. The Data controls guide says it stays out of history, does not create or update memory, and is not used to improve models while it remains temporary. OpenAI may keep a copy for safety for up to 30 days. Newer controls permit a temporary conversation to draw on existing context when a user chooses a personalized temporary chat. A saved temporary conversation becomes a regular one. Temporary describes the conversation's treatment, not an absolute prohibition on using prior context.
A file can be a separate retained object. OpenAI's retention guidance states: "Deleting a chat does not delete a file that remains saved in Library." Files in GPTs and projects have their own deletion triggers. Removing the conversation in which a document was discussed does not remove every saved copy.
Memory is another layer. In Memory in ChatGPT, OpenAI lists past chats, saved memories, custom instructions, Library files, and connected apps among potential personalization sources. The newer memory summary "does not necessarily include every detail or source" that can inform a response. It is a review surface, not a complete inventory.
The instructions for full removal are more demanding than closing a toggle. The same guidance warns: "Deleting a chat alone does not necessarily delete a separate saved memory". A person may need to remove the memory, original and archived conversations, Library files, and other sources; a connected account may need to be disconnected. Turning memory off stops ordinary personalization but leaves past chats in place. OpenAI also describes separate safety uses of limited context. It may retain deleted saved-memory logs for up to 30 days.
Dots makes the boundaries easier to see
OpenAI introduced dots on September 29, 2026. A dot is an always-on agent with a cloud computer, access to authorized plugins, and the ability to continue work between interactions. OpenAI describes an initial rollout to eligible Pro, Business Premium, and Enterprise users. This is a product feature, not another name for ChatGPT's older memory setting.
The dots privacy, security, and safety FAQ says plugin permissions are shared across dots, ChatGPT, ChatGPT Work, and Codex. A dot can use an existing connection within the scope already granted. It can also receive memories and recent conversation context from ChatGPT, and its conversations can contribute to ChatGPT memory. A person connecting a work application for one workflow should understand which other authorized surfaces can use that connection.
The FAQ says dot context can persist "for as long as you keep your dot". It may include information from conversations and plugins, although OpenAI says the context does not retain credentials, images, or screenshots. Individual dot memories currently cannot be viewed, deleted, or directly edited. Deleting the dot deletes its own context, but separately saved ChatGPT conversations, Codex threads, and files do not disappear automatically.
Two controls have particularly narrow effects. Turning off ChatGPT Memory stops sharing with the dot; the FAQ says "It does not delete information that your dot has already received." Disconnecting a plugin stops new access through that connection, not context previously built from it. Deleting the dot, clearing ChatGPT memories, deleting generated files, and disconnecting apps solve different parts of the problem.
Dots also changes when information is collected. Proactive research can read permitted sources and keep private notes before another request. OpenAI says these research tools cannot directly send messages, modify connected services, or control a computer or browser; subsequent actions follow approval rules. Safety checks, custom rules, and action reviews are relevant protections. The Service Terms, section 14, nevertheless say "You are responsible for actions they take" on your behalf. Oversight remains consequential when an agent is active while its owner is elsewhere.
Model improvement is a separate switch
The Privacy Policy, section 2, says user content may be used "to train the models that power ChatGPT". For personal ChatGPT accounts, the Data controls guide specifies the opt-out: "your new conversations won’t be used to train OpenAI models" when Improve the model for everyone is off. Existing saved chats remain. Turning training off does not turn off processing needed to answer a request, delete data, or automatically disable memory.
The dots FAQ extends the same setting to eligible dot work on personal plans: conversations, actions, delegated work, automations, and connected-app information brought into those tasks may be involved. It says proactive background research and its notes are not used directly for training, but information later brought into an eligible task can be. OpenAI says some human review for safety may occur even after model improvement is disabled.
Connected Google services have a qualification. OpenAI's Google app data controls FAQ says "We do not train our generalized models on data directly from connected Google apps", subject to stated exceptions: feedback submissions, manual copying or uploads into conversations, and material included in ChatGPT's response. Those exceptions and the dots guidance should be read together, rather than replacing either with a blanket claim that all connected information is trained on—or that none can enter training.
The Data controls guidance says OpenAI does not train on ChatGPT Business, Enterprise, Edu, and Healthcare workspace content by default. Different business agreements, administrator controls, and retention settings apply. Plan, source, action, and settings all affect the answer to the question: is this data used to train a model?
Which other parties are involved?
The Privacy Policy, section 3, names "Vendors, Service Providers, and Marketing Partners". It describes hosting, cloud infrastructure, support, safety, payments, analytics, communication services, search and shopping providers, and selected marketing partners, with different roles and restrictions. It also describes affiliates; legal and security disclosures; corporate transactions; and access for business-account administrators. These are disclosed categories, not evidence that each partner receives every user's conversations.
The advertising distinction should stay exact. OpenAI says it does not sell users' data to advertisers or give advertisers their private conversations. Its advertising principles state "we never sell your data to advertisers". That assurance coexists with ad-personalization processing and the policy's disclosure of limited information to certain marketing partners. Those are not identical types of sharing.
A connected application adds its own boundary. The Service Terms, section 7, say ChatGPT can send relevant content and some location information to the connected application. OpenAI adds: "We are not responsible for App Data after it has been provided to an Application", except for applications it owns. The recipient's terms govern information there. A deletion request to OpenAI does not, by itself, instruct every external service to erase a record it has received. The destination of an action matters as much as the setting that authorized it.
Where the information goes
The map separates the documented paths for retained conversations, personalized context, training eligibility and third-party exchange. Their use depends on account settings and the task.
Prompts / files / activity / connected apps
|
v
OpenAI services
|
+------------+-------------+
| | |
v v v
Chat history Memory Dots
& Library summary agent context
| | |
| +-------> future answers
| |
+--------------------------+
|
eligible tasks
|
model improvement
(account setting)
Other possible flows from services:
-> service providers / affiliates
-> external apps and actions (their policies)
-> legal and safety disclosures
Diagram: conversation history, memory, dot context and external destinations have separate retention and deletion paths.
The comparison that matters
| Question | ChatGPT as documented in October 2026 | A privacy-first personal-context design |
|---|---|---|
| Where does context live? | Chats, Library, remembered context, and dot context can be distinct stores within a hosted service. | A user-controlled local index is the primary record; any cloud copy has a defined role. |
| What enters an answer? | Eligible prior chats, files, memories, connected apps, and agent context, subject to controls. | Context is selected for each request, with a visible source list and an explicit recipient. |
| Can it train a general model? | Depends on plan, settings, workflow, and source-specific rules. | Personal context is excluded from general-model training as a system property. |
| What happens on disconnect? | New plugin access stops; previously retained memory or dot context may remain. | Access is revoked and derived context can be identified and removed. |
| Can one memory be removed? | ChatGPT offers memory controls; individual dot memories cannot currently be edited or deleted. | Each stored item and derived assertion is inspectable, correctable, and erasable. |
| What does deletion cover? | Chats, Library files, memories, dots, and third-party recipients have different processes. | One deletion request follows data lineage and reports external exceptions. |
The second column summarizes published behavior, not a security finding about OpenAI's implementation. The third describes architectural choices a privacy-first product can make; they do not follow automatically from local storage.
What a privacy-first product changes
A privacy-first assistant would begin with a smaller transfer, not a more elaborate settings page. It would build its model of a person's work where that person controls the underlying data, then disclose only the context required for a particular answer or action. An email thread needed to prepare a reply does not automatically have to become durable memory available to every tool the person uses later.
It would make a remembered fact traceable. The person could see the source, which model or tool received it, whether it was copied to another store, and when it expires. Corrections would alter the retained representation rather than only asking the model to avoid mentioning an old one. Revoking a connector would expose a decision about context already derived from that connector, not only stop retrieval.
Training would have a fixed boundary: private context would never become general-model training material through an unrelated interaction or feedback flow. Cloud execution could remain available when needed, but its role, retention window, and third-party recipients would be visible before transfer. Encryption would protect stored and transmitted material; it would not replace an answer to who processes the plaintext.
A local-first system also handles device availability, backups, synchronization, lost keys and retrieval costs. Third-party actions still send information outside the person's control. No system can retract an email already delivered or reverse a purchase merely by erasing its own history. A serious privacy design distinguishes what it can delete from what it can only revoke, request, or disclose.
OpenAI's documents describe real controls and protections, especially around training preferences, temporary chats, workspace policies, and agent approvals. They also show how many places a useful assistant may retain context. The more work such a system can do without being asked again, the more important it becomes to know which part of a person's life remains in which store—and which deletion actually reaches it.
