What do AI privacy settings control?

Open the settings of any AI assistant and you will find several switches that all sound like “privacy”: memory, chat history, improve the model for everyone. Which one does what? It is genuinely hard to tell.

Each tool names these controls differently, puts them in different menus, and has its own idea of what “delete” means. This post walks through ChatGPT, Gemini, Claude, Perplexity, Cursor and Codex, with the settings I would change and the real incidents that show why it matters. The post is written for everyday users, so no legal fine print.

A caution first: these menus move around often. If a label below does not match your screen, look for the nearest equivalent. Unless I say otherwise, this is about personal (consumer) accounts. Business, Enterprise and API plans usually follow different terms.

Accuracy checked: 28 October 2026, against each vendor’s help pages (linked in every section).

The four AI privacy questions: history, memory, training and retention

AI privacy settings are four independent controls that decide what a chatbot stores, what it carries into new chats, what the provider may train on and how long copies survive. Every tool in this post combines the same four ideas:

1. History: can you find the conversation again?
2. Memory: can facts carry into new chats (“you live in Lisbon, you prefer Python”)?
3. Training: may the provider use your content to improve its models?
4. Retention: how long does a copy stay stored somewhere, even after it disappears from your screen?

You can have history on and training off. You can switch memory off and still have history. Deleting a chat does not necessarily delete what memory learned from it. And a chat you cannot see any more may still sit on a server for days or weeks. Keep these four apart in your head and the menus get much easier to read.

Diagram 1. Four questions, four different switches. Answering one does not answer the others.

Retention is the one that surprises people most, so here is what the vendors publish for their private modes:

The six rows describe different situations, not equivalent promises. Diagram 2 puts the three published periods side by side.

Diagram 2. “Temporary” is relative: days, not minutes.

Why do AI privacy settings matter? Three real incidents

Shared links ended up in search results. In 2025, ChatGPT’s “make this chat discoverable” option on shared links led to conversations appearing in Google. One report counted more than 4,500 links containing names, CVs and confidential work content. OpenAI pulled the option and worked to remove the indexed pages. Lesson: a shared link is a published page.

“Deleted” turned out to mean “kept for a court”. In May 2025 a US court ordered OpenAI to preserve ChatGPT output logs, including chats users had deleted, as part of a copyright case. The obligation to keep new data ended on 26 September 2025, but logs already saved stay available to the plaintiffs. That was a specific legal event, not OpenAI’s normal retention policy. Lesson: retention is also decided by courts, not just settings.

A default quietly changed. In August 2025 Anthropic introduced a choice to allow chats to improve Claude for Free, Pro and Max accounts. Say yes and de-identified data may be kept for up to five years, say no and the data is not used for training. Lesson: privacy terms can change after you signed up, so re-check them now and then.

ChatGPT privacy settings: training, memory, Temporary Chat and shared links

• Training: Settings → Data Controls → Improve the model for everyone. Switching it off keeps your history, as OpenAI explains in its data controls article.
• Memory: ChatGPT can save facts and refer to past chats. You can switch both off, or review saved memories, under Settings (look for Personalization or Memory, as OpenAI has moved it). Deleting a saved memory does not erase mentions in old chats, and OpenAI may keep a log of deleted memories for up to 30 days for safety, according to the memory FAQ.
• Temporary Chat: not in history, not used for training, but kept for up to 30 days for safety. Good for one-off sensitive questions. Not a vault.
• Shared links: if you ever shared a chat, review those links in Data Controls. Per OpenAI’s shared links FAQ, deleting the original chat also removes its link. Anyone who already imported a copy into their own history keeps it, and that is outside your control.

Gemini privacy settings: Keep Activity, memory summary and temporary chats

Gemini splits things differently: Keep Activity governs history and review, while a separate Memory summary governs what it remembers about you.

• History: with Keep Activity on, activity older than 18 months is auto-deleted by default. You can choose 3 or 36 months, or “Don’t auto-delete”, per Google’s help page.
• Memory: the Memory summary can be viewed, edited, deleted or switched off on its own, and a Temporary Chat keeps a conversation out of personalisation. Switching Keep Activity off is not the same thing as switching memory off.
• Training and humans: a subset of chats is read by trained reviewers. Reviewed chats are kept for up to three years, disconnected from your account, and deleting your activity does not remove them.
• Switching Keep Activity off: future chats are not used for training, but they are still stored with your account for 72 hours to run the service. There is an exception: if you submit feedback, Google also uses the last 24 hours of that chat, and reviewed feedback can be kept for up to three years. Switching it off may also limit some connected-app features, so test the ones you rely on. Privacy settings are often a trade-off between protection and convenience.
• Temporary chats: not used to train Google’s models, and kept for 72 hours.

My pick: set auto-delete to 3 months and use temporary chats for anything personal. Do not tick the feedback box on a chat you would not want a stranger to read.

Claude privacy settings: training opt-out, memory and incognito chats

Claude offers the clearest controls of the six, in my opinion.

• Training: a toggle in Privacy settings. Opted in, chats may be kept in de-identified form for up to five years; opted out, deleted chats leave Anthropic’s back-end storage within 30 days. Anthropic’s retention page adds that flagged content can be kept for up to two years, and a “no” does not pull data out of models already trained. The toggle covers Free, Pro and Max, including Claude Code on those accounts, but not Team, Enterprise or API.
• Memory: on by default for Free, Pro and Max. Go to Settings → Memory to view, edit, pause or reset it. Deleting a conversation does not delete memories created from it, per the memory help page.
• One chat without memory: turn Memory off in the “+” menu before your first message. Turning Memory off affects memory only. Incognito is the option that also keeps the chat out of history.
• Incognito (ghost icon): not saved to history or memory, and never used for training, even if sharing is on. Incognito is not instant deletion: Anthropic’s incognito help page says incognito chats are retained for 30 days by default, and Enterprise organisations can set a longer period. Less retained, not unretained.

Perplexity privacy settings: AI data usage, memory and incognito

• Training: a toggle under Settings → Account that Perplexity’s pages call AI Data Usage or AI Data Retention. The label differs between help articles, so look for the one about using your data to improve models. See the account settings page.
• Memory: Settings → Personalize → Manage memories. Switching memory off does not clear what is stored; use Manage memories to delete entries, and note a log of cleared memories may be kept up to 30 days, per the memory article.
• Incognito: profile icon → Incognito. Memory and previous searches are off and the thread stays out of your history. Perplexity’s account page says incognito searches are “never stored”. I could not find a published retention period on the pages I checked, so I would not rely on a specific number.
• History: threads stay in your Library until you delete them.

Cursor Privacy Mode: what it limits and what it does not

For a coding tool, the question is where your code goes.

• Privacy Mode: press Cmd+Shift+J (Ctrl+Shift+J on Windows or Linux), or open Cursor Settings from the menu, go to General and switch Privacy Mode on. Per Cursor’s privacy page, neither Cursor nor model providers then train on your code.
• What it is: a restriction on how your data may be used, not a promise that nothing leaves your computer. Prompts and code context still travel to Cursor’s servers and on to model providers such as OpenAI, Anthropic and Google. Privacy Mode adds the no-training rule and zero data retention agreements, with some documented exceptions, so read the page for the model you use.
• Default: Privacy Mode is on by default for Teams. The page does not state the default for individual plans, so check yours.
• Own API keys: requests still pass through Cursor’s backend, and the zero data retention agreements do not apply, so your provider’s policy governs.
• Deletion: Cursor says you can request deletion of personal data through support.

Diagram 3. Privacy Mode limits what happens to your code after it is sent. It does not stop it being sent.

Codex CLI privacy: what stays on your computer and what reaches OpenAI

Codex adds an extra question: what happens locally, and what happens when the model processes your request? These are two separate stories.

Training controls. On a personal ChatGPT plan, the ChatGPT setting Improve the model for everyone (see OpenAI’s data controls) also applies to Codex. Codex then has a second, separate setting for training on full environments, which the ChatGPT toggle does not change. Check both. This is one product with two training switches, which is rather the point of this post. I could not open OpenAI’s own page for the second setting while writing, so confirm it in your Codex settings.

Local files. Much of what Codex remembers lives on your computer. OpenAI marks its separate memories feature as experimental and off by default, and the config lives at ~/.codex/config.toml, per the Codex documentation. The layout depends on the version you have installed. This is what one installation of mine looks like:

ls -la ~/.codex

auth.json   config.toml   history.jsonl   logs_2.sqlite   memories/   sessions/   state_5.sqlite   ...

Treat these like a diary and a key ring. Session files can hold prompts, code snippets, file paths and tool output. Never commit auth.json or share your home directory.

You can look without opening anything private. The two commands below only read sizes and permissions:

du -sh ~/.codex/* 2>/dev/null
ls -l ~/.codex/auth.json

Deleting local files is not deleting cloud data. Removing sessions/ does not necessarily remove entries in history.jsonl, the databases, backups or anything OpenAI holds. Session files can also be useful for resuming work, so I no longer suggest clearing them on a schedule. Check the documentation for your version before deleting anything. I could not confirm from OpenAI’s documentation exactly how long server-side data is kept for Codex, so for ChatGPT sign-ins, start with your ChatGPT data controls. I covered related safeguards in Codex CLI, part 2.

AI privacy settings compared: ChatGPT, Gemini, Claude, Perplexity, Cursor and Codex

Which AI privacy settings should you change first?

1. Opt out of training in ChatGPT, Claude and Perplexity. You keep the features and lose nothing day to day.
2. Shorten Gemini’s auto-delete to 3 months.
3. Read your saved memories in ChatGPT, Claude and Perplexity. Delete anything you would not say to a stranger.
4. Use temporary or incognito chats for health, money, legal and HR questions. Temporary chats are less retained, not unretained.
5. Check your shared links and remove old ones.
6. Switch Privacy Mode on in Cursor, and remember it limits use, not transmission.
7. Inspect Codex’s local files (ls -la ~/.codex) before deleting anything, review both training settings, and keep auth.json out of Git.
8. Redact before you paste. Never share passwords, API keys or client data. See the next section.
9. Review quarterly. Put a reminder in your calendar.

How do you redact sensitive data before pasting into an AI chatbot?

“Do not paste secrets” is easy advice to give and slightly irritating to follow. What do you do instead? Swap the secret for a label before you hit enter.

Unsafe:

Help me debug this API request. My API key is sk-prod-EXAMPLE-SECRET and the customer is Jane Smith, email jane@example.com.

Safer:

Help me debug this API request. I have replaced the API key with REDACTED_API_KEY and removed the customer’s identifying details. Here is the error and the relevant code.

The assistant needs the error and the shape of the problem, not the real key. With coding agents the same care applies to .env files, database exports, private keys, logs and customer data. One more trap: ignoring a file in Git does not stop an AI assistant reading it. File access is controlled by the assistant’s own settings (Cursor, for example, has a .cursorignore file), so check those separately.

AI privacy audit checklist: ten minutes, nine boxes

Ten minutes, nine boxes. Copy this list somewhere you will see it in three months:

• ☐ Check whether your conversations may be used for model training
• ☐ Review what each assistant remembers about you
• ☐ Check how long temporary or incognito chats are retained
• ☐ Review chat history and auto-delete settings
• ☐ Remove shared links you no longer need
• ☐ Switch Privacy Mode on in Cursor
• ☐ Inspect local Codex history and credential files (read-only, delete nothing yet)
• ☐ Check connected apps and their permissions
• ☐ Redact sensitive information before submitting prompts

How AI memory and retention work: the notebook-on-a-café-table model

Think of an AI tool as a notebook on a café table. History is the notebook, memory is the sticky notes the waiter keeps about you, and training is whether the café photocopies pages for its recipe book. Retention is how long copies stay in the back office after you have torn out the original page. Tearing out a page (deleting a chat) does not remove the sticky note, the photocopy or the back-office copy. That is why you need to ask all four questions.

How memory works, in broad strokes. Vendors do not publish the internals, but the documented behaviour points to two mechanisms. One keeps short notes extracted from your chats in a separate store: the waiter’s sticky notes. That is why deleting a chat leaves them behind. Anthropic says so plainly in its memory help page. The other searches your old conversations when asked: the waiter flipping back through the notebook. That is why the original chat matters too. To clear something properly, delete the memory entry and the chat. Some older Team and Enterprise accounts use a different, summary-based memory, so check which one you have.

Final thoughts: deleting a chat is not deleting your data

Deleting a conversation removes the visible copy, not the memories, training use or server-side retention behind it. And turning off training is not the same as keeping your data private. None of this means avoiding AI. It means choosing what they keep, on purpose. For agents with wider access, read The Digital Butler or Trojan Horse?, and for coding tools, Using AI Code Assistants Safely. Which setting surprised you most? I would love to hear it.

References

• OpenAI, Data controls in ChatGPT
• OpenAI, Memory in ChatGPT
• OpenAI, How ChatGPT protects privacy and ChatGPT shared links FAQ
• Google, Gemini Apps Activity and how Gemini uses your chats
• Anthropic, Updates to consumer terms and data retention
• Anthropic, Use incognito chats
• Anthropic, Claude memory
• Perplexity, Memory and Account settings
• Cursor, Privacy and Keyboard shortcuts
• OpenAI, Codex configuration
• Search Engine Journal, OpenAI pulls shared ChatGPT chats from Google
• Engadget, OpenAI no longer has to preserve all ChatGPT data