Is the OpenAI API private? The API vs the app at six AI companies

The Morse teamPublished October 31, 20269 min read

The OpenAI API is more private than ChatGPT on training, since as of October 2026 OpenAI doesn't train on data sent to its API unless you opt in, while ChatGPT Free, Plus, and Pro may train on your chats by default. It isn't hidden from OpenAI, though. OpenAI keeps API prompts and responses in abuse-monitoring logs for up to 30 days, stores Responses API conversations for 30 days by default, and gives zero data retention only to customers it approves.

We read the API data pages and the consumer app pages of OpenAI, Anthropic, Google, xAI, DeepSeek, and Mistral on October 31, 2026, and set them side by side below. The API is usually the stricter of the two, but not at every company, and not in every way. Google's free API tier trains on your prompts, and Google's paid API keeps them longer than the Gemini app does with activity off. An app built on an API also keeps your history under its own policy, not the model maker's.

Does OpenAI train on API data?

No, not by default. OpenAI's data controls page for developers says that "as of March 1, 2023, data sent to the OpenAI API is not used to train or improve OpenAI models," unless you opt in to share data. Its help center adds that API organization owners can turn data sharing on, and then members can choose to share feedback and the current API Playground chat.

ChatGPT works the other way. The same help page says that on Free, Plus, and Pro, "we may use your content to train our models," and that you opt out by turning off Improve the model for everyone under Settings, then Data controls. A thumbs up or down still sends "the entire conversation associated with that feedback" to training, even after you opt out. We cover the app's settings in is ChatGPT private.

How long does OpenAI keep API data?

Up to 30 days for most requests, and longer for anything you store on purpose. OpenAI's developer data page, read October 31, 2026, lists these periods:

• Abuse-monitoring logs: kept "up to 30 days" by default, and they "may contain certain customer content, such as prompts and responses."
• Responses API: a "30 day Application State retention period by default, or when the store parameter is set to true."
• Assistants, threads, and vector stores: kept until you delete them, then removed 30 days later.
• Files, conversations, fine-tuning data, and batches: kept until you delete them.
• Images, embeddings, speech, moderations, and realtime: no application state stored.

OpenAI deserves credit for publishing retention endpoint by endpoint, in more detail than any of the other five companies, and customers it approves can keep content out of these logs, as we explain in what is zero data retention.

Is the API more private than the app at each AI company?

At four of the six, the API trains less than the app by default, at least on a paid account. Retention is mixed. Every cell below links to the page it came from, read on October 31, 2026. For what each consumer app does in more depth, see our pages on Claude, Gemini, Grok, DeepSeek, and Mistral's Vibe.

Four APIs don't train by default (OpenAI, Anthropic, xAI, and Google's paid tier), two have free tiers that may train (Google and Mistral), and one, DeepSeek, doesn't say. All six consumer apps train by default or until you switch it off. For a wider look at what each app collects beyond your chats, see what data AI chatbots collect.

Is the free Gemini API private?

No. Google's Gemini API terms, last updated April 28, 2026, say that on unpaid services, "including, for example, Google AI Studio and the unpaid quota on Gemini API," Google uses what you submit "to provide, improve, and develop Google products and services and machine learning technologies." They add that "human reviewers may read, annotate, and process your API input and output," after Google disconnects it from your Google account, API key, and Cloud project. The terms also say, "Do not submit sensitive, confidential, or personal information to the Unpaid Services."

The paid tier is different, and narrowly defined. API access counts as paid "only when accessing the API through a Cloud Project associated with an active billing account." On paid services, Google says it "doesn't use your prompts" or responses to improve its products. Where you live changes this too: in the European Economic Area, Switzerland, and the UK, the paid data terms apply to every service, free quota included.

The paid tier still keeps your prompts for a while. Google's usage policies page, updated June 9, 2026, says it "retains the following data for fifty-five (55) days": your prompts, the context you send, and the model's output, to detect and prevent policy violations. Flagged content may be read by "authorized Google employees." That's longer than the Gemini app keeps a chat with Keep Activity off, which Google puts at 72 hours (Google). So a paid Gemini API key trains less than the app but keeps prompts longer than the app's most private setting.

Do Anthropic, xAI, Mistral, and DeepSeek train on API data?

Anthropic and xAI don't by default. Mistral's free tier may, and DeepSeek's terms are silent.

• Anthropic. "By default, we will not use your inputs or outputs from our commercial products" to train, and the API is one of them (Anthropic, updated August 18, 2026). Feedback you choose to send is the exception: it can be trained on, and Anthropic keeps it for up to 5 years. Its Mythos-class models keep prompts and outputs for 30 days even under zero data retention (Anthropic).
• xAI. Its security FAQ says it "never trains on your API inputs or outputs without your explicit permission," and stores requests and responses for 30 days (xAI). Our Grok 4.7 page covers the rest of xAI's API terms.
• Mistral. On Mistral Studio's free mode, "we may use your data (input and output) to train our artificial intelligence models," with a right to opt out (Mistral). The switch is in the Admin panel, under Privacy, in the Anonymous improvement data section, and it's separate from Vibe's: "Opting out of one does not opt you out of the other" (Mistral). Zero data retention is pay-as-you-go only, by request, and Mistral approves or denies it "at our discretion" (Mistral).
• DeepSeek. Its open platform terms, effective April 29, 2026, don't say whether DeepSeek trains on API inputs or how long it keeps them. They say DeepSeek handles a developer's personal information under its general privacy policy, which says inputs may be used "to train and improve our technology" and stores data "in People's Republic of China."

Is an app built on the OpenAI API as private as the API?

Not automatically. When you use an app built on the API, the app is OpenAI's customer and you are the app's. OpenAI's privacy policy says it "does not apply to content that we process on behalf of customers of our business offerings, such as our API," and that this data is governed by its customer agreements. xAI's privacy policy says that if you reach its service "through a third-party's service," then "the third-party's privacy policy would apply." DeepSeek's privacy policy calls the developer "the controller" and says it should tell users its own rules.

So ask the app three questions:

1. Where does it keep your history? Most multi-model apps store your threads on their own servers. We compared where each one keeps them in T3 Chat alternatives.
2. Does it send something that identifies you? OpenAI asks developers to send a "safety identifier" with each request, a string "that uniquely identifies each user," and to hash the username or email first. OpenAI says these create "a stable way to trace activity back to an individual end user" (OpenAI).
3. Which tier does it run on? An app on free Gemini or Mistral keys inherits those tiers' training terms.

Should you use the API yourself for privacy?

It helps with training and hurts with identity. Your own API key runs under the company's API terms, but the account behind it has your name, email, and billing details. If you go this way:

• On OpenAI, set store to false on the Responses API, so conversation state isn't kept for 30 days, and don't send feedback in the Playground if your organization shares data.
• On Google, use a Cloud project with active billing, so your prompts fall under the paid terms, and remember the 55-day abuse log.
• On Mistral, turn off Anonymous improvement data in the Admin panel, even on a paid account.
• On DeepSeek, assume the general privacy policy applies, since the platform terms don't say otherwise.

None of these hide who you are from the company. For that, see our guide to using ChatGPT anonymously.

How Morse sends GPT, Claude, and Gemini without your name on it

Every row in the table comes back to an account. Your words reach the model maker under your own API account, with your billing details, or under an app's account that keeps your history on its servers. Morse is built to remove both, with a privacy mode you choose for each chat. In Anonymous mode our proxy sends the message under Morse's own account, and in every mode your history stays off our servers.

• Anonymous, for GPT, Claude, and Gemini without the provider knowing it's you. Morse's proxy removes your account, email, and IP address and sends the message under Morse's own account. The provider still sees the message to answer it, and may keep it for a limited time to check for abuse, under its own policy. So leave out names and details that point to you.
• Private, for prompts you'd rather no host keep. It's the default for a new chat. Open-weight models like DeepSeek, Kimi, and GLM, plus Grok, run under the zero data retention agreements Morse has with its inference, search, and other providers. Where a provider confirms zero retention on each reply, Morse checks it and refuses a reply that doesn't.
• E2EE, for anything no one should read. Your browser checks a secure enclave's hardware attestation, then encrypts the message so only that enclave can open it. Morse's servers relay ciphertext they can't read. The enclaves are run by third-party providers, and the guarantee rests on the enclave hardware and attestation working as designed. E2EE chats come with Pro, at $19 a month.

Your chat history is stored only in your browser, encrypted, and locked when you sign out. Morse's servers don't keep your messages or log what you write. Morse doesn't train AI on your content, sell your data, or show ads (privacy policy). Clearing your browser deletes the chats for good, and Morse can't recover them, so copy anything you need to keep.

Try a chat from the Morse home page without an account, or start free with no card needed.