Who can read what your AI’s memory keeps, system by system
A memory can have four kinds of reader: you; whoever runs your account, if it’s a work or team account; the company that stores it; and the maker of the model, which reads whatever part of the memory reaches a chat.
For the big assistants, the memory sits on the vendor’s servers. Staff access is limited by policy. Some vendors have people review a sample of chats to improve the product or check safety. Most privacy policies we read allow disclosure under legal process, and many on the company’s own good-faith judgement too. On work accounts an admin often can read the memory. A memory stored on your own machine takes the company out of the store, but it doesn’t change the last reader: what a cloud model reads still goes to its maker with your chat.
Counterparts, the memory we make for Claude, answers this both ways. The local install keeps everything in one folder, ~/.counterparts (the memories in one SQLite file, plus a short-lived buffer of conversation text, markdown copies of its journal and backups), readable by your account on that machine, and we never receive it. Hosted Counterparts, for claude.ai, is coming soon, in beta; it keeps the memory on our server, and it isn’t end-to-end encrypted: we could technically read it, and “we don’t read it” is a promise, not something the system enforces or records. Our own answer is below.
This is a research summary. An AI drafted this page from the sources below and another AI checked it. No person has run these steps. An AI read each system’s own docs, privacy policy or source on November 3, 2026, and ran the permission check below in a throwaway home folder. OpenAI’s consumer help pages, privacy policy and enterprise privacy page refused the download, so the ChatGPT row covers only what its ChatGPT Work docs say. Counterparts is ours.
The assistants
As of early November, from each company’s own pages. “Docs don’t say” and “not stated in the pages we read” mean we looked in the pages we downloaded and found nothing either way.
| System | Where it’s kept | Who can read it | What reaches the model’s maker | Deleting it |
|---|---|---|---|---|
| ChatGPT (OpenAI) | OpenAI’s service. Business plans: “encrypted in transit and at rest”. Consumer pages: not read | Business: admins of eligible workspaces get “covered ChatGPT conversation records” through the Compliance API; whether that includes saved memories, docs don’t say. OpenAI staff: not read (its enterprise privacy page refused our download too, and the ChatGPT Work docs don’t address it). Consumer: not read | OpenAI makes the model. Business data “is not used to train OpenAI models by default”. Consumer: not read | Business: “Deleting a conversation doesn’t necessarily delete an existing saved memory”; delete memories separately |
| Claude (Anthropic) | Anthropic’s servers, “stored with encryption at rest”. On by default on Free, Pro, Max and Ultra; on Team and Enterprise, off until each member turns it on | You. Team and Enterprise owners “can’t view or edit a user’s individual memories” in the app, but memory entries are included in the organization’s conversation history exports, which the Primary Owner can run. Anthropic staff: “By default, Anthropic employees cannot access your conversations unless” you send feedback or a Usage Policy review is needed; if you allow training, model-training personnel see de-linked chats (below) | Anthropic makes the model. Consumer plans: chats may be used for training “unless you opt out” (flagged chats and feedback are used even then). Commercial plans: not by default | Delete one memory, or Reset memory to delete all. On the current memory, deleting a chat leaves its memories in place |
| Gemini (Google) | Your Google Account, as part of Gemini Apps Activity; memory needs Keep Activity on, which is on by default for adults | You. Human reviewers, including Google’s service providers, read a subset of chats to improve Google’s services; chats are disconnected from your account before they go to service providers. Turning Keep Activity off stops that review for future chats, but Google says it “still uses your chats to respond to you and help protect Google, our users, and the public, including with help from human reviewers” (below). Not available on work or school accounts; admins there can search and export Gemini chats with Vault | Google makes the model. With Keep Activity on, chats are used to train; with it off, they aren’t, unless you send feedback. Google adds that “Your Gemini settings don’t control processing of your chats to create anonymized data to improve Google services” | Delete the chats it learned from; the memory summary can also be edited. Chats picked for human review are kept up to three years, even if you delete your activity |
| Microsoft Copilot | Work accounts: “in the user’s Exchange mailbox in a hidden folder”. Consumer: where, docs don’t say | Work: “Admins can search their users’ memory” with Purview eDiscovery, and temporary chats are discoverable. Memories “follow the same security and compliance policies as other mailbox data, such as Customer Lockbox and encryption at rest”, and Microsoft says Microsoft 365 Copilot has opted out of the abuse monitoring that “includes human review of content”. Consumer: you. Microsoft’s privacy statement says it uses conversation data to “troubleshoot and fix bugs” and “prevent abuse”, and manually reviews some AI results; whether people read consumer conversations, the new app’s pages don’t say (below) | Consumer: “models from Microsoft, OpenAI, and other model developers”. Work: OpenAI and Anthropic models, Anthropic on by default for most customers outside the EU, EFTA and UK. Work and the new consumer app: not used to train foundation models. Consumer: “Personalized ads might use your chat history, saved memories, and other Microsoft data you’ve chosen to share” | Delete memories in settings. Work: deleting a chat doesn’t delete them. Consumer: turning memory off doesn’t delete them either. Purview retention policies “don’t apply to Copilot memory” |
| Perplexity | Perplexity’s servers: “secure production environments”, on AWS | You. Perplexity engineers get “temporary access to sensitive resources only when necessary, such as for debugging purposes”; the pages we read don’t mention human review, and its consumer terms license Perplexity to use your content to run and improve the service and reserve the right to “screen” it (below). Enterprise: memories “belong to the organization, not the individual user”; whether an admin can read a member’s memories, docs don’t say | Models from OpenAI, Anthropic, Google, xAI and Perplexity’s own Sonar. Perplexity says its providers don’t retain or train on the data. Perplexity itself may train on memory unless you turn off AI Data Retention, on by default for Free, Pro and Max; opt-outs only apply to data collected afterwards, and after opting out “Data may still be processed for service operation, legal compliance, and product improvement”. Enterprise: it “never uses memory content to improve models” | Clear one memory or all of them; a log of cleared memories is kept “for up to 30 days”. Turning memory off doesn’t clear it on individual plans; on Enterprise, turning it off deletes your memories, and an admin turning it off deletes everyone’s |
| Counterparts hosted (ours; coming soon, in beta) | Our server, on Railway, in a store of its own; backups that leave it go to Cloudflare R2, encrypted with a key for your account, which we hold. Cloudflare receives that key whenever a backup is read or written | You. We could technically read it: the live file isn’t end-to-end or file-level encrypted, and “we don’t read it” is a promise, not something the system enforces or records | What you say in claude.ai, and the memories Claude reads there, go to Anthropic | Download all of it, or delete the account: it locks at once and is erased after 24 hours, or at once with “Delete everything now”. No single-memory delete |
Memory platforms inside other apps
These are memories developers build into their own apps. If you use such an app, the app’s maker holds the account, and the platform’s staff sit one step further back.
| System | Where it’s kept | Who can read it | What reaches the model’s maker | Deleting it |
|---|---|---|---|---|
| Mem0 | Platform: “on Mem0’s servers”. Open source: wherever you run it | Org and project members (a Reader “can view and search memories”). Mem0: “Authorized personnel and vetted service providers/processors” (its privacy policy; data it processes for business customers falls under their agreements and DPA, which we didn’t read) | Platform: AI providers “such as OpenAI and Anthropic”, or your own key. Mem0 trains on Free Plan data, “not ... on data from Paid Plan users”. Open source calls OpenAI by default | Delete APIs and account deletion; “typically within a few minutes” |
| Zep | Zep’s cloud, or your own cloud on Enterprise; Graphiti uses your graph database | Account-level roles come with “full access to every project”. “Zep Support cannot open your account” until you give it a 72-hour, read-only grant. Zep’s terms (Aug 17, 2026) give Zep a licence “to access, use, reproduce, modify, and create derivative works from Customer Data for any lawful purpose”; a signed DPA governs on personal data where the two conflict | A model “Zep operates through its model gateway”; which provider, docs don’t say; or your own OpenAI, Anthropic or Google key. The same licence covers using customer data “to train and improve machine learning and artificial intelligence models”. Graphiti defaults to OpenAI | Deletion is permanent, but backups last up to 365 days |
| Supermemory | Its managed cloud by default, or a self-hosted binary (not open source) in | Admins have full access; members full or restricted. Supermemory staff access: not stated in the pages we read; its terms give it the right “to store, process, and transmit Customer Data solely to provide the Services” | Its docs: “Supermemory runs its own proprietary models”. Its privacy policy: content “may be processed by” OpenAI and Google Gemini. It says content is “never used to train models” | “Forget” only marks a memory forgotten; deleting the namespace removes it |
| Letta | Letta’s cloud, as a git repo it hosts per agent, or | Org admins “can also access all agents and conversations”. Letta staff: “We do not actively review Your Content”. Its privacy policy lets it share information with “subsidiaries, independent contractors, and/or research partners”, including “to facilitate model training and refinement”, and its terms give it a licence “to use Your Content as necessary to provide the Services” that “extends to trusted third parties that we work with” | Letta’s model gateway, to the provider you pick; for cloud agents its docs list Anthropic, OpenAI, Google Gemini, Amazon Bedrock, OpenRouter and others. Its privacy policy says hosted data may be used “to train new models in the future” and names no opt-out besides limiting use of hosted services | Delete the agent; whether that removes its hosted memory, docs don’t say |
| Cognee | Your machine by default, or Cognee Cloud on AWS with a database per customer | Invited users “gain access to all tenant-wide datasets”. Cognee staff access to customer data: not stated in the pages we read | Open source: your configured provider, OpenAI by default, or a local model with no key. Cloud: an open model run by an unnamed provider. Training: not stated in the pages we read | Forget removes graph, vector and relational data; Cloud workspaces go 30 days after the subscription ends |
| LangMem | Whatever LangGraph store you choose: in memory, Postgres, or LangChain’s cloud | On LangChain’s cloud, org admins have access to all workspaces. LangChain’s terms count Customer Data as confidential and “limit access to its and its Affiliates’ employees and contractors with a need to know” | The model you configure. LangChain “will not use Customer Data to train” | Its tools delete memories; platform retention after that, not read |
| Hyperconsciousness | An encrypted store on one machine or server of yours | The owner, plus whoever the owner grants. “There is no operator-held copy or support back door” | What you grant a model: “Hosted model providers can see the plaintext returned through their grants” | Append-only; corrections add history, and deletion “is not secure erasure” |
Memories on your own machine
Here the store is a file you hold, so “who can read it” mostly means who can read your files. What still leaves through the model, and how to check, is in our local memory guide.
| System | Where it’s kept | Who can read it | What reaches the model’s maker | Deleting it |
|---|---|---|---|---|
| Counterparts (ours) | One folder, | Your account on that machine. We never receive it; the local install has no Counterparts server | What Claude reads from it goes to Anthropic with your session and a once-a-day background run | Remove |
| Claude Code’s built-in memory | Plain files in | You; a project’s committed | The first 200 lines or 25KB of | Edit or delete the files, or use |
| Basic Memory | Markdown in | You. Cloud: workspace roles and per-project visibility, and on partner-managed workspaces, “Partner staff may be able to access, configure, support, or administer your workspace”. Basic Memory: “We don’t read your data - Except when necessary for support requests you initiate” | Search runs locally by default. Whichever AI you connect reads what it opens; Cloud agents run a DeepSeek model on Fireworks AI. “never uses your content to train AI models” | Delete the files. Cloud: kept 30 days after you cancel, backups up to 90 |
| claude-mem |
| You. Synced memory: “anyone who has [your MCP link] can read the memory you have synced”. cmem.ai staff access: not stated in the pages we read | Each observation is compressed by a model: Claude on your plan by default, or cmem.ai’s own gateway model with CMEM Pro, maker not named | Delete the local database yourself; cmem.ai’s “Delete account & data” doesn’t reach it |
| Engram Alpha | A file in | You; “Any process on your machine can use the API” | No model runs in the core; your assistant reads it over MCP | Hard delete from its pane; freed pages “aren’t scrubbed” |
| agent-qa |
| Anyone with the repo, once committed | Whichever model you configure, with screenshots unless |
|
| MCP Memory (Knowledge Graph server) | One | Whoever can read that file; a new file takes your default permissions | Whatever the client’s model reads | Its delete tools, or the file |
| Screenpipe |
| You. On company deployments, shared storage “can make captured data available to authorized administrators”. Content you send to its cloud features comes under a perpetual, sublicensable licence, and Screenpipe reserves the right to “screen” it (terms) | The AI provider you pick: local Ollama keeps it home; Screenpipe’s hosted AI routes to Google Vertex, Anthropic or OpenAI. Its terms say it doesn’t train on customer content “unless you separately and expressly agree in writing”, but it may train on deidentified data made from it | Delete |
| trusty-memory | The OS data folder ( | Your user; its socket folder is 0700 and it checks the caller’s user ID | Local search; with an OpenRouter key, its chat and consolidation send memories to OpenRouter (Claude Haiku by default) |
|
Who at the company can read it
What the companies say happens on their side of the connection:
- Anthropic: “By default, Anthropic employees cannot access your conversations unless” you share them as feedback or “Review is needed to enforce our Usage Policy”, and in that case “only designated members of our Trust & Safety team may access this data on a need-to-know basis”. Flagged chats are kept “for up to 2 years”. If you allow your chats to be used to improve Claude, they’re de-linked from your user ID “before any review” and “Access is limited to a small number of personnel involved in model training.” Its privacy policy also names service providers it shares data with, for purposes including “investigating and resolving safety and security issues, preventing and investigating fraud, abuse, and violations of our Usage Policy”.
- Google: “A subset of chats are reviewed by human reviewers (including Google’s trained service providers) to help improve Google services”, and “Chats are also reviewed to keep Gemini safe and secure for everyone and to address violations of the Google Terms of Service”. “Chats are disconnected from your account before being sent to service providers”; Google doesn’t say the same for its own reviewers. Turning Keep Activity off stops the review for improving its services, but “Google still uses your chats to respond to you and help protect Google, our users, and the public, including with help from human reviewers.” On Workspace accounts, chats “won’t be reviewed by human reviewers ... without your permission”.
- Microsoft: for Microsoft 365 Copilot, abuse monitoring “which includes human review of content” is available in Azure OpenAI, but “Microsoft Copilot services have opted out of it”. For the consumer app, the old privacy FAQ said “an opt-out of human review is not available”, and Microsoft now says that FAQ “applies only to the older version of the Microsoft Copilot app”; the new app’s pages say feedback you send is “reviewed by Microsoft’s operations teams” but don’t say whether people review conversations. Microsoft’s general privacy statement says “Our processing of personal data involves both automated and manual (human) methods”, and that to improve its AI systems “we manually review some of the results against the underlying data”.
- Perplexity: the pages we read don’t mention human review. Engineers get “temporary access to sensitive resources only when necessary, such as for debugging purposes.” Its consumer terms license Perplexity, in order to operate the service, to “access, use, host, cache, store, reproduce, transmit, display, publish, distribute, and modify Your Content to operate, improve, promote and provide the Services”, and reserve the right “to remove, screen, edit, or delete any of Your Content at any time, for any reason, and without notice”; they don’t cover Enterprise, whose terms we didn’t read.
- OpenAI: its consumer pages and its enterprise privacy page refused our download, and the ChatGPT Work docs we read don’t address staff access.
For the platforms and local tools, the lines are in the tables. Zep’s Support team needs a 72-hour grant from you to open your account (“Zep Support cannot open your account”), and Zep’s terms separately give the company a licence to customer data “for any lawful purpose”. Other terms grant a licence too. Supermemory’s is “solely to provide the Services” and Letta’s “as necessary to provide the Services”; Perplexity’s and Screenpipe’s are wider, as their rows say.
Legal requests
The assistants whose policies we could read, and most of the platforms, say they answer valid legal process, and most of their privacy policies also allow disclosure on the company’s own judgement, for safety, fraud or enforcing their terms. Each policy is linked in the References.
- Anthropic: its government-requests policy says it doesn’t disclose user information to governments “except in accordance with valid legal process (eg., a validly issued subpoena or warrant)”, or in an emergency involving “imminent physical harm or death”, and that it will notify you except where the law forbids it or in rare cases such as a child at risk or an emergency. Its privacy policy is wider: “We may share personal data with government authorities, law enforcement, or other third parties” on “a good-faith belief that disclosure is reasonably necessary” to comply with the law, “prevent serious harm to any person or to property”, “address fraud or other illegal activity”, or “enforce our terms”.
- Google, Microsoft, Mem0, Zep, Letta and LangChain give good-faith grounds of the same kind. Microsoft’s covers “your content”, and it lists enforcing “the terms governing the use of our services”. For enterprise products such as Microsoft 365 Copilot, the statement says that where it conflicts with the customer’s agreements, “the terms of those agreement(s) will control”; we didn’t read those agreements.
- Perplexity, Supermemory and Screenpipe name legal process, and also safety, fraud or protecting their rights, without the words “good faith”. Perplexity’s privacy notice and terms don’t cover Enterprise, whose terms we didn’t read.
- Cognee: its privacy notice has no law-enforcement line. Its general terms for orders let either side disclose confidential information “required to be disclosed by law, regulation, or court order” with “prompt written notice” where the law allows. They define customer data separately and don’t say whether it counts as confidential information. Its terms-of-service page returned “Page not found”, so these order terms are the only terms we read.
- cmem.ai, which holds synced claude-mem memory: its privacy page has no legal-process line. Basic Memory, in its privacy policy, lists “Comply with legal obligations” among its purposes. Hyperconsciousness says “There is no operator-held copy”, so there’s no company copy to ask for.
Anthropic, Google and Microsoft publish transparency reports; the other pages we read don’t mention one.
A store on your machine changes who a request goes to: unless it syncs to the vendor’s cloud, there’s no company copy of the store to ask for. What a session sent to the model’s maker is held by that maker, under its own retention.
Work and team accounts
On a work account, the person who can read your memory may be your employer, so check before you put anything personal in.
- Microsoft 365 Copilot is the most open to admins: memories sit in your mailbox, admins can search them with eDiscovery, temporary chats are discoverable, and “Memory and personalization actions don’t generate audit log entries in Purview.”
- Claude Team and Enterprise: owners can’t open your memories in the app, but they can get them in an export: Anthropic says “Memory entries are included in standard conversation history exports”, and organization exports belong to the Primary Owner. For organizations still on the older memory, Anthropic says “All memory will be retained and exportable by admins”. Incognito chats don’t feed memory but “remain available to owners through data export”. An owner turning memory off for the organization deletes every member’s memories at once. We haven’t run an export ourselves.
- Gemini: memory isn’t available on work or school accounts. Admins can still “retain, hold, search, and export Gemini app conversations with Vault”.
- ChatGPT business plans: the Compliance API gives eligible workspaces conversation records for “an approved electronic discovery workflow”.
- Perplexity Enterprise: memories belong to the organization. Turning memory off for the organization deletes them all.
On your own machine: what “your account” means
File permissions of 700 and 600 keep other ordinary accounts on the computer out. They don’t stop an administrator: the system grants the super-user read access to every file. Any program you run, including another AI tool with file access, runs as your account and can read it too. Anyone at your unlocked computer reads as you, and a backup of your home folder, such as Time Machine, copies the store too unless you exclude it (tmutil addexclusion <path> on a Mac; an excluded store can’t be restored from Time Machine).
To see the permissions on Counterparts’ store, run this in a terminal on a Mac or Linux:
ls -ld ~/.counterparts ~/.counterparts/store
ls -l ~/.counterparts/store/counterparts.sqliteAn AI ran it on a Mac after a fresh bun add -g counterparts and counterparts install, in a throwaway home folder. Both folders showed drwx------ and the file -rw-------, owned by that account. The plugin install wasn’t checked this way.
Counterparts: our own answer
Local install (Claude Code on a Mac or Linux, Claude Desktop on a Mac). Everything Counterparts keeps is in ~/.counterparts on your computer. We never receive it, and the local install has no server of ours for it to go to. Claude writes the memories itself, in its own words, keeps what matters and lets the rest fade. What it reads in a session, and in a once-a-day background run on your own plan, goes to Anthropic under your Claude plan, as it would without Counterparts. A daily update check asks npm for a version number and carries nothing about you. The privacy page has the full list.
Hosted (claude.ai on the web and in the apps; coming soon, in beta). Your memories are on our server, on Railway, in a store of their own. The live file isn’t end-to-end or file-level encrypted, so we could technically read it; in our privacy page’s words, “We don’t read it” is our promise, not something the system enforces or records. Its audit log records account events, not anyone opening your memory. Backups that leave the server go to Cloudflare R2, encrypted with a key that belongs to your account, and we hold that key: it protects you from leaked backups, not from us. The copy we make on our server before an upgrade isn’t under that key, and goes once it’s 15 days old, the next time Claude wakes your memory. Cloudflare, which stores the backups, receives that key whenever a backup is read or written. Hosted keeps no transcript, because claude.ai sends none; it keeps only what Claude writes through Counterparts’ tools. You can download your whole memory or delete the account; you can’t remove a single memory there. Hosted privacy, in full.
Keeping the store on your machine
If you use Claude and want the store on your own computer, Counterparts for Claude Code is ours, free and open source. In Claude Code on a Mac or Linux, run /plugin marketplace add mlapeter/counterparts, then /plugin install counterparts@counterparts, and restart. For Claude Desktop on a Mac, install it from a terminal with bun 1.3 or newer (bun add -g counterparts), quit Desktop, run counterparts install --host claude-desktop, reopen Desktop and set the counterparts tools to Always allow. It doesn’t run on Windows, or with ChatGPT, Cursor or Gemini. There, the nearest fit is a local tool from the table above that runs as an MCP server, such as Basic Memory, whose README says it “exposes these tools to any MCP client”, if your app accepts one. We haven’t tried them there.
On claude.ai, hosted Counterparts is coming soon, in beta, with the operator caveat above. Sign up on the home page to hear when it opens. To compare memories by where they live, our directory lists all 21 in these tables.
Questions people ask
Are humans reading my ChatGPT chats?
This page can’t answer that from OpenAI’s own words: its help center, privacy policy and enterprise privacy page refused our automated download when we read the other vendors’ docs, so the ChatGPT row covers only what OpenAI’s ChatGPT Work docs say. To answer it yourself, open OpenAI’s privacy policy and its help articles on data controls, and look for three things the other vendors spell out: whether staff or contractors review conversations, whether flagged content is kept longer, and whether turning off training changes either. For comparison, Google says “A subset of chats are reviewed by human reviewers (including Google’s trained service providers)”, and Anthropic says “By default, Anthropic employees cannot access your conversations unless” you share them as feedback or “Review is needed to enforce our Usage Policy”; separately, if you allow training, “Access is limited to a small number of personnel involved in model training.”
Can Anthropic see my Claude memory?
Anthropic’s privacy center says “By default, Anthropic employees cannot access your conversations unless” you share them as feedback or “Review is needed to enforce our Usage Policy”, and in that case “only designated members of our Trust & Safety team may access this data on a need-to-know basis”. If you allow your chats to be used to improve Claude, they’re de-linked from your user ID first and “Access is limited to a small number of personnel involved in model training.” Its privacy policy also lists service providers it shares data with, for purposes including “investigating and resolving safety and security issues”, and the legal grounds in the police answer below. Memory entries “are stored with encryption at rest”, and Anthropic doesn’t describe them as end-to-end encrypted.
Is my AI memory used for training?
It depends on the plan and a setting. On Claude’s consumer plans, Anthropic may train on your chats “unless you opt out through your account settings”, and its privacy policy adds: “Even if you opt-out, we will use Inputs and Outputs for model improvement when” your conversations are flagged for safety review or you’ve reported them to Anthropic, for example as feedback. Google trains on Gemini chats while Keep Activity is on, which is the default for adults, and says “Your Gemini settings don’t control processing of your chats to create anonymized data to improve Google services”. Microsoft says the new consumer Copilot app’s prompts and responses “aren’t used to train foundation models”, and its privacy statement says “Microsoft Copilot also uses prompts and related data to provide and improve services, including relevant advertising”. Perplexity says it “may use content from memory to improve our models” unless you turn off AI Data Retention, which is on by default for Free, Pro and Max. Its data-collection page adds that opt-outs “only apply to data collected after the opt-out date”, “Previously collected training data cannot be deleted or removed”, and after opting out “Data may still be processed for service operation, legal compliance, and product improvement”. Business plans from OpenAI, Anthropic, Google and Microsoft don’t train on your data by default, and Perplexity says it “never uses memory content to improve models for Enterprise users”. Among developer platforms, Mem0 trains on Free Plan data, Zep’s terms license customer data for training, Letta’s privacy policy says hosted data may be used “to train new models in the future”, and Supermemory, LangChain and Basic Memory say they don’t train on it. Among local tools, claude-mem’s cloud service says “we do not use the content of your memory to train models”.
Does Claude report conversations to the police?
For government requests, Anthropic’s policy is that it doesn’t disclose user information “except in accordance with valid legal process (eg., a validly issued subpoena or warrant)”, with an exception “if we believe there is an emergency that may result in imminent physical harm or death”. Its privacy policy gives wider grounds: “We may share personal data with government authorities, law enforcement, or other third parties where, based on the information available to us, we have a good-faith belief that disclosure is reasonably necessary”, among other things to “prevent serious harm to any person or to property”, to “detect, prevent, or otherwise address fraud or other illegal activity”, or to “enforce our terms”. It says it will tell you when your data is requested “unless we believe we’re legally prohibited from doing so, or other rare exceptions apply, including where a child is at risk of harm or in cases of emergency”, and it publishes a transparency report of government requests. Google’s, Microsoft’s, Perplexity’s and most of the platforms’ privacy policies give legal-process grounds, and most of them safety, fraud or terms-enforcement grounds as well (Legal requests). None of them promises a memory is out of reach of a court.
Do humans read flagged AI conversations?
At Anthropic, a flagged conversation can be read by its Trust & Safety team, and flagged inputs and outputs are kept “for up to 2 years”. At Google, “Chats are also reviewed to keep Gemini safe and secure for everyone and to address violations of the Google Terms of Service”, and “Reviewed chats are retained for up to three years”, even if you delete your activity. Google says chats “are disconnected from your account before being sent to service providers”; it doesn’t say the same for its own reviewers. Microsoft says Microsoft 365 Copilot has opted out of Azure OpenAI’s abuse monitoring, “which includes human review of content”. For the consumer Copilot app, the old privacy FAQ said “Some Copilot conversations are subject to both automated and human review for product improvement and digital safety purposes”; Microsoft says that FAQ applies only to the older app, and the new app’s pages don’t say whether people review conversations. The Perplexity pages we read don’t mention human review, though its consumer terms reserve the right “to remove, screen, edit, or delete any of Your Content at any time”.
Can my employer see my AI memory?
On some work accounts, yes. In Microsoft 365 Copilot, “Admins can search their users’ memory” through Purview eDiscovery. Anthropic says Team and Enterprise owners “can’t view or edit a user’s individual memories” in the app, but also that “Memory entries are included in standard conversation history exports”, and the Primary Owner can export the organization’s data; for organizations still on the older memory, “All memory will be retained and exportable by admins”. Gemini’s memory isn’t available on work or school accounts, but admins can search and export Gemini chats with Vault. Perplexity says Enterprise memories “belong to the organization, not the individual user”.
If my AI memory is stored locally, does the model’s maker still see it?
Whatever a cloud model reads from it, yes: a local store changes who holds the file, and the parts a session reads still go to the model’s maker with your chat, unless the model also runs on your machine. Our local memory guide covers what leaves the machine for eight local systems, and the section below covers who else on the computer can read the file.
Who can read what I tell Counterparts?
Counterparts is the memory we make. On the local install for Claude Code and Claude Desktop, the memory is in one folder, ~/.counterparts (the memories in one SQLite file, plus a short-lived buffer of conversation text, markdown copies of its journal and backups), readable by your account on that machine, and we never receive it: there’s no Counterparts server behind it. What Claude reads from it goes to Anthropic with your session, and with a once-a-day background run on your own plan, as everything in a Claude session does. Hosted Counterparts, for claude.ai, is coming soon, in beta; its memory is on our server, and it isn’t end-to-end or file-level encrypted, so we could technically read it. “We don’t read it” is our promise, not something the system enforces or records (privacy page).
Is Counterparts end-to-end encrypted?
No. The local install keeps the memory in a file on your own machine, protected by your account’s file permissions. Hosted Counterparts, coming soon, in beta, will keep it on our server without end-to-end or file-level encryption; backups that leave the server are encrypted with a key that belongs to your account, which we hold, so that protects against leaked backups, not against us. The copy we make on our server before an upgrade isn’t encrypted with that key, and goes once it’s 15 days old, the next time Claude wakes your memory (privacy page).
Does deleting a chat delete what the AI remembered from it?
Usually not. Claude (on its current memory), ChatGPT’s business plans and Microsoft 365 Copilot all document that deleting a chat leaves memories made from it in place; you delete those separately. Perplexity keeps memories in their own list in Settings, cleared one by one or all at once. Gemini works the other way: “To delete something that Gemini remembered about you, delete all chats with this info”.
Questions? Ask in r/AIMemorySystems.
References
- Anthropic: Claude memory, Who can view my conversations, How Anthropic protects personal data, Retention, Government requests, Team data, Organization exports, Commercial training, Privacy policy, Transparency, Claude Code memory and data usage
- OpenAI: ChatGPT Work docs; privacy policy, enterprise privacy and memory FAQ not read (they refused our download)
- Google: Gemini Apps Privacy Hub, Gemini memory, Activity, Workspace, Vault, Privacy policy
- Microsoft: Microsoft 365 Copilot memory, Microsoft 365 Copilot privacy, Anthropic as subprocessor, eDiscovery, consumer privacy controls, activity history, older app FAQ, Privacy statement
- Perplexity: Memory, Enterprise memory, Data collection, Third-party providers, Models, Security, Privacy policy, Terms
- Platforms: Mem0 privacy, FAQ, orgs; Zep terms, privacy, support access, retention, roles; Supermemory security, privacy, terms; Letta privacy, terms, permissions; Cognee data and security, privacy notice, customer terms; LangChain terms, privacy, admin; Hyperconsciousness README, constraints
- Local tools: Basic Memory and its privacy page; claude-mem installation, cloud sync, cmem.ai privacy; Engram Alpha security; agent-qa memory; MCP Memory; Screenpipe FAQ, privacy, terms; trusty-memory
- Counterparts: Privacy, Claude Code page, README
- macOS:
man 2 intro(File Access Permissions),man tmutil, Time Machine