You deleted your AI chat history. Is it actually gone?

From your screen, yes, all gone after you click delete. From everything underneath, it depends on how the system was built.

Nobody advertises their delete button. Scroll through the feature page of any app that invites you to write about your life: memory, personalization, insights, streaks, and almost never a paragraph about what happens when you delete something. The truth behind the button is complicated, and complicated answers don't survive contact with a marketing page.

I'm building a place people confide in, where they write down things they haven't said out loud to anyone. The AI was the harder problem, and I knew that from the start. Delete was the one I underestimated, and the same gap shows up in products far larger than mine: deleting a conversation reaches the conversation, and whatever the system built from it is handled somewhere else, under its own settings, if at all.

The naive delete#

Here's the naive view from the building side, the one I started with. Delete means gone: the entry comes out of the system, the screen updates, done. That code takes about twenty minutes to write, programmers have been writing it since the seventies, and nothing ever comes back to contradict it, so the sense of having finished can sit unchallenged for years. What it misses doesn't live anywhere you'd think to look.

I found this out when I built delete properly. Wiping everything, the whole account, is the blunter promise: everything in the system hangs off each user, so pulling that root takes the whole tree down with it. Deleting one item belonging to a user is harder to do cleanly. A single journal turned out to be connected to everything around it: the highlights pulled from each entry, the search index built over them, the observations that cite them.

My first version of delete was a checklist: go to each of the seven places where pieces of a journal live and remove them, one by one. A checklist is only as complete as its author's memory. And it didn't erase anything, out of caution: erasing is irreversible, and a young system should fear its own bugs more than anything else. One mistaken erasure and someone's words are gone for good. So I did what most delete buttons do at first: mark each piece as deleted and hide it. The entry stays in the database wearing a deleted label, and every screen agrees not to show it. Engineers call this a soft delete. Nothing breaks, and nothing is lost to a bug or a misclick. It also means nothing is actually wiped out.

And hiding is the shallow end of the problem. A system like this stores what you write, and then it makes things from it: a summary of that stretch of days, themes it noticed, threads connecting that week to the weeks around it. A summary of your week contains your week. A delete that only reaches the source leaves those derivatives carrying you: words gone, meaning kept, and for a confidant, the meaning is the worse half to keep.

Deletion as an architecture#

Somewhere in that work I understood that deletion needs to be treated as an architecture, not merely a button. The version I trust now asks the question at the other end. Instead of asking "what should I remove?" each time someone presses delete, it asks once, at the moment each new kind of data is wired in: what happens to this piece when the thing it's attached to disappears? Every connection carries its answer: die together, an entry and the highlights taken from it, or survive with the link blanked. There is no checklist to keep up to date, because nothing can be attached without answering the question. When delete runs, the removal spreads along the connections on its own. Engineers call that a cascade, and what it removes is erased rather than labeled, the hard delete. It can still fail in two directions: reach too little and your words stay behind, reach too eagerly and you tear out things that should have survived. But the failure would be visible in the structure, not hiding in a list somebody forgot to update.

Even with the cascade, doing it properly is far from easy, because entries and derivations don't map one to one. One entry feeds several summaries; one summary blends several entries. So when one entry goes, anything built partly from it poses a question with no clean answer. Rebuild the summary as if the entry had never existed, and you've rewritten something you already read, a small falsification of your own past. Throw it away whole, and you've destroyed what the other entries put into it. Keep it, and some of the deleted entry's meaning stays behind. Every system that understands your writing sits somewhere in that triangle, usually without telling you where. Further down I'll tell you where mine sits.

And that's just the layer that's supposed to know you. There are also the layers that aren't: temporary copies, activity logs, backups, the duplicates infrastructure makes because infrastructure is built to never lose anything. Deletion has to visit every room in the house, including the rooms you forgot you built.

None of that work shows. Nobody screenshots a delete working correctly, and no user can verify one from the outside, so it never wins against a roadmap; the button stays on the screen while what it reaches underneath shrinks. Nobody decided to deceive you, but a hundred small prioritization meetings made it drift.

What the policies say#

This is worth keeping in mind when you read a privacy policy, because a policy describes intentions, and deletion is a property of systems. A few public reference points. OpenAI's consumer policy says deleted chats are removed from its systems within about 30 days. Yet in 2025 a court preservation order, issued in litigation OpenAI itself fought, required consumer chats to be kept regardless. For over four months, pressing delete removed nothing, and for the first weeks, people deleting under a thirty-day promise had no way to know. The order ended in September 2025, and a later ruling ordered OpenAI to hand the plaintiffs a de-identified sample of twenty million conversations. Google's terms for Gemini say conversations sampled for human review are retained for up to three years, and that this retention survives deleting your activity. Apple's Journal app, at the other end, stores entries end-to-end encrypted, which is a structural answer rather than a promised one; it also makes comparatively little from what you write. It is the vault. That's the tradeoff underneath all of this: the more a system does with your words, the harder it is for your words to ever fully leave. You can have a vault, or you can have a confidant.

The preservation order is the most instructive of those reference points because of how little anyone's conduct had to do with it: OpenAI wrote the thirty-day promise and fought the order, and deletion stopped anyway. A policy can stop being true in two ways: the system can drift out from under it, or an order from outside can overrule it. An architecture is what stays true either way.

The fear around all this runs in both directions, sometimes in the same person in the same week. People worry that the chat history they deleted still exists somewhere, and they worry that things they wanted kept will vanish in a purge or an account glitch. These feel like opposite fears, but they ask the same question about custody: who actually holds your words, and on what terms? In both cases, not you. Someone else's architecture does, on terms that were settled before you ever typed a word.

Three questions#

You can't change terms that were never yours to set. But you can learn them before you decide what to hand over, and it takes three questions.

Do they train their AI on what I write? Always check what's the default, because the default is what happens to most people's words; a toggle buried in settings changes it only for the people who go looking.

What does it retain, and for how long? Look for specific numbers. Vague language ("for as long as necessary to provide the service") is itself an answer.

And the third: when I delete something, does the deletion reach everything derived from my words, or just the words themselves?

The first two can be answered from a policy page. The third can only be answered by how the system was built. In my case it ended up meaning that the layer that distills what you write is separate from the layer that talks with you, and deletion has to walk the distillation layer as well. That separation is the sort of compromise you should make from day one. A product that never made it can't answer the question, and neither can its builders. When you ask these questions you can learn a lot from a clear answer, and almost as much from a vague one.

The same questions, answered about my system#

Does my writing train the AI model? How long is it kept? When I delete, what actually dies? Here are the answers for the system I built, quoted from the privacy policy we published rather than paraphrased into something friendlier.

Does what you write train the model?#

"Nothing you write is used to train AI models, not by us and not by our providers."

The second half of that sentence is the part to notice, because it is where a policy can go quiet and still be true: a product can say it doesn't train on your words, be right, and never mention what the model provider underneath does. So the policy names the providers and their windows: "Anthropic, which generates the AI's responses, deletes its API inputs and outputs within 30 days, keeping them longer only if its safety systems flag a violation. Google's Vertex AI computes the search index for your own journals inside the same Google Cloud environment that hosts your data, and does not train on your words either." And because promises like this tend to soften as companies grow, there is a line pinning the future down: "Any future use of data for broader research would be a separate, clearly described, opt-in choice." Opt-in means asked first.

How long is it kept?#

"We keep your entries, and the understanding we build from them, for as long as your account is active or until you delete them."

Notice that it names two things: what you wrote, and what the system came to understand from it. Both stay for the life of the account; what deletion reaches of the second is the caveat I will quote in full below. The mechanics are self-serve: "Delete individual journals inside the app, or your entire account from Settings." One thing does take an email: "If you also want our pseudonymized internal research notes about your usage removed, email us and we'll delete those too, subject to anything we're legally required to keep." Journals and account, you delete yourself. The notes we made while studying our own product, you ask for. We put that distinction in writing because pretending everything is one button would be tidier, and less true.

When you delete, what actually dies?#

The full answer has rough edges. We put them in the policy on purpose.

The first is the backup window.

"If you delete a journal or your account, it is erased from our active systems immediately, and from encrypted backups within 7 days, except where we're legally required to retain something."

For up to seven days after you delete, an encrypted copy can still exist in a backup. The backup exists for the second of the two fears from earlier, the vanishing one: if a bug or a bad deploy corrupts the database, a backup is the only way anyone gets their words back. It is a sealed copy, taken daily, and deletion cannot reach inside a sealed copy; a backup forgets by aging out. Seven days is the balance between the two fears: enough sealed copies to recover from a disaster, even one noticed late, and few enough that what you deleted is not sitting in copies for months. The legal carve-out sits at the end of that same sentence, where you can't miss it. Vague language here would be "industry-standard retention practices." The number and the exception would disappear inside it.

The second is the policy's answer to the third question.

"insights already generated in other journals, and weekly reflections, may have drawn on content you later delete; deleting a single journal does not unwind those, deleting your whole account removes them too."

Understanding, once formed, does not un-form cleanly. If a pattern the system noticed drew on a journal you later remove, deleting that one journal does not reach back and rewrite everything it touched. Deleting your account does.

The third is grain. Delete works on a journal or on the whole account, and nothing smaller: no button removes a single message. A finer delete is not built yet; other work has come first. If the grain gets finer, the policy will say so.

The fourth sits outside our systems. Anthropic deletes its copies of API traffic within 30 days of each exchange, so the most recent stretch of a journal you delete can still exist there until that window closes. Our delete does not reach it; their schedule, quoted above, is what erases it.

If you ever consider using it, read the policy itself, not just my excerpts. It is in plain English, and now you know exactly which sentences to look for.