What types of user data does OpenAI store from chat interactions and for how long?

1. What kinds of conversation content are retained: prompts, responses, files and memories

OpenAI records the substantive content users send and receive—each prompt and model response is stored as part of the conversation history and can be saved to an account until the user deletes it (chats and attachments are explicitly saved to an account) ^{[1] [5]}; uploaded files and images provided in chats are treated as inputs and retained according to the same platform and project settings ^[4].

2. The technical and log metadata that accompanies every interaction

Beyond message text, OpenAI collects log data that includes technical connection information—IP address, browser type, timestamps and other telemetry—because the privacy policy and help pages list log data and device/browser information as collected data ^[6]. These operational logs are used to provide, maintain and analyze the service, and to investigate abuse or security incidents as described in OpenAI documentation ^{[6] [2]}.

3. Retention timelines for consumer chats: saved until deletion, deleted chats cleared in ~30 days, legal exceptions

For consumer ChatGPT accounts the company states chats remain in history until manually deleted, and deleted conversations are removed from systems within roughly 30 days under normal policy; however deleted items can be preserved longer when required by legal or security obligations ^{[1] [2] [3]}. Public reporting and third‑party summaries also documented a 2025 court preservation order that temporarily required OpenAI to preserve chats beyond normal deletion windows, and OpenAI later said it was no longer under an indefinite retention order for consumer content after litigation developments ^{[7] [3]}.

4. Enterprise and API customers: configurable controls and different rules

Enterprise and business offerings give organizations ownership and control over inputs/outputs, encryption in transit and at rest, and options not available to consumer accounts—by default enterprise data is not used to train OpenAI models and customers can enable Zero Data Retention, which causes API endpoints to treat store parameters as false so data isn’t retained for training ^{[8] [4]}. The privacy policy also distinguishes customer‑controlled business data (API/enterprise) from consumer data and says those flows are governed by customer agreements ^[6].

5. Training and model‑improvement use, opt‑outs and memory settings

If users opt into “Improve the model for everyone,” their chats and saved memories may be used to train and improve models; conversely, Temporary Chats and user data controls let signed‑in users prevent conversation content from being used for training and delete memories, with memory intended for longer‑term personalization unless turned off ^{[5] [2]}. The platform therefore splits behavior between opt‑in personalization (memories, training) and opt‑out privacy modes (Temporary Chats) ^{[5] [2]}.

6. Gaps, disputes and competing narratives to watch

Public reporting and vendor posts highlight friction points: third‑party writeups and blog posts assert broader or indefinite retention and questioned GDPR compliance, and an account of a court order claimed OpenAI had to preserve deleted chats indefinitely ^{[7] [9]}, while OpenAI’s response to media litigation and its help pages emphasize the 30‑day deletion schedule and that the indefinite preservation order no longer applies to consumer content after court developments ^{[3] [2]}. Sources therefore diverge on duration under exceptional legal process and on interpretations of compliance, so the record contains documented policy statements from OpenAI and contested external commentary.