{"course":{"slug":"context-engineering","title":"Context Engineering","url":"https://addaly.com/learn/context-engineering","level":"advanced","track":"build"},"lesson":{"slug":"forgetting-on-purpose","title":"Deleting what you kept","url":"https://addaly.com/learn/context-engineering/forgetting-on-purpose","position":56,"of":87,"minutes":9,"answer":"User text ends up in ten stores, so keep an inventory of every one of them as code, give each a deliberate retention period, and make erasure a tested function that asserts zero remaining rows.","keyIdea":"User text ends up in ten stores, so keep an inventory of every one of them as code, give each a deliberate retention period, and make erasure a tested function that asserts zero remaining rows, while treating embeddings and derived summaries as personal data and leaving the legal questions, which differ by country and remain unsettled, to lawyers."},"body":{"format":"markdown","text":"## Context makes copies, and copies outlive the window\n\nA context window is transient. The infrastructure around it is not. By the time a user's sentence has been through a typical pipeline, it exists in more places than anybody has counted:\n\n- The conversation store.\n- The assembled-request log, if you log the rendered prompt, which the measurement module will recommend.\n- The trace or observability system.\n- The vector index, as an embedding, plus the chunk text stored beside it.\n- The keyword index.\n- The retrieval cache and any response cache.\n- The memory store.\n- An evaluation set somebody built from real conversations.\n- The provider's own retention, for whatever period their terms state.\n- Your database backups, for their retention period.\n\nTen places. A deletion request that reaches two of them has not deleted anything; it has made the data harder to find while leaving it there.\n\n## Write the inventory before you need it\n\nThe single most useful artefact here is a list: every store that can contain user text, who owns it, what its retention is, and how deletion is performed on it.\n\nWrite it now, while there are six entries. It is a page. Writing it during an incident or a regulator's enquiry, when there are eleven entries and two of them are somebody's notebook, is a different exercise entirely.\n\nAnd give each entry a retention period chosen on purpose. \"Forever, because nobody set one\" is the default and it is the wrong answer for every store on that list except possibly the transcript.\n\n## Deletion has to be a tested operation\n\nTreat it like any other critical path: it needs a function, a test, and an assertion.\n\n```python\ndef erase_user(user_id):\n    for store in ALL_STORES:          # the inventory, as code\n        store.delete_for_user(user_id)\n    for store in ALL_STORES:\n        assert store.count_for_user(user_id) == 0, store.name\n```\n\nHaving `ALL_STORES` as a list in code, rather than as a paragraph in a document, is what stops the eleventh store from being forgotten when somebody adds it in March. A new store that is not in the list fails the test.\n\nThe assertion matters more than the deletion. Plenty of systems have a delete path that silently misses a store, and nobody notices, because a successful deletion looks exactly like a deletion that did nothing.\n\n## The parts that are hard\n\nThree honest difficulties, none of which has a tidy answer.\n\n**Embeddings.** A vector derived from a sentence is not the sentence, but it is derived from it, and research on inverting embeddings back into approximate text has shown it is far more feasible than most people assumed. Treat vectors as personal data and delete them with everything else, rather than arguing that they are anonymous.\n\n**Derived artefacts.** A summary, a memory entry, a generated chunk context, a fine-tuning dataset. Each contains the user's information in transformed form. The summary is deletable; a model trained on the data is not, in any practical sense, which is a strong argument for not training on production conversations without a clear basis and a clear consent path.\n\n**Backups.** You cannot selectively delete from an immutable snapshot. The common practice is a documented backup retention window after which the data ages out, plus a suppression list so restored data is re-deleted. Whether that satisfies a given regulator is exactly the kind of question that needs a lawyer rather than an engineer.\n\n## The law\n\nRights to erasure and correction exist in the EU's GDPR, India's DPDP Act, California's regime and many others. They are broadly similar in shape and differ in the details that matter: what counts as personal data, which exceptions apply, how long you have, whether inferred data is covered, and what a legal-obligation exception permits you to retain.\n\nThe application of all of this to AI systems is actively contested and moving. There are open questions (about training data, about model weights as a form of retention, about automated inference) where practitioners, regulators and courts do not yet agree, and where the answer differs by country.\n\nSo this lesson does not tell you what the law requires of you, and could not. It tells you what to build so that whatever your lawyers conclude is implementable: an inventory, a per-store retention period, a tested erase function, and no derived artefact whose provenance you cannot trace.\n\n## Forgetting as a feature\n\nOne last framing, because it is more useful than the compliance one. A user asking \"forget that\" is asking for a product behaviour, not filing a legal request. Support it directly: a delete button next to each memory, a way to clear a conversation, an ephemeral mode that retains nothing.\n\nSystems that make forgetting easy get used more freely, because a user who cannot delete something learns to be careful about what they say. That caution costs you the context that would have made the product work."},"check":{"question":"A team implements deletion across the conversation store and the memory store, and considers the requirement met. What is the most likely gap?","options":[{"text":"Backups retain the data until their retention window expires, which no code path can shorten.","correct":false,"tempting":"A genuine and well-known difficulty, but it is usually the one teams have already thought about."},{"text":"Derived copies (the vector index, prompt logs, traces, caches and evaluation sets) still contain the same text.","correct":true},{"text":"The provider's retention period means the data persists outside the team's systems.","correct":false,"tempting":"True and worth knowing, but it is contractual rather than something the deletion path can address."},{"text":"Embeddings are not personal data, so they are correctly excluded from deletion.","correct":false,"tempting":"States a conclusion that inversion research undermines; vectors derived from text should be deleted with it."}]},"prev":{"slug":"the-handover-note","title":"Passing context to whoever comes next","url":"https://addaly.com/learn/context-engineering/the-handover-note"},"next":{"slug":"telling-the-user-it-forgot","title":"Being honest about a bounded window","url":"https://addaly.com/learn/context-engineering/telling-the-user-it-forgot"},"authorship":"Founder and series editor: Dr Mustafa Mun. Written by AI models to a written standard. Exam keys checked blind by a second model: 3,665 of 3,666 agreed. Academic review invited.","review":{"status":"Draft, open for academic review"},"cite":"Addaly (2026) 'Deleting what you kept', in Context Engineering. Edited by M. Mun. Addaly. Available at: https://addaly.com/learn/context-engineering/forgetting-on-purpose (Accessed: 13 October 2026).","licence":{"name":"CC BY-NC-SA 4.0","url":"https://creativecommons.org/licenses/by-nc-sa/4.0/"},"reader":{"schema":1,"title":"Deleting what you kept","courseTitle":"Context Engineering","module":{"index":6,"slug":"conversation-and-memory","title":"Conversation, memory and compaction"},"answer":null,"keyIdea":"User text ends up in ten stores, so keep an inventory of every one of them as code, give each a deliberate retention period, and make erasure a tested function that asserts zero remaining rows, while treating embeddings and derived summaries as personal data and leaving the legal questions, which differ by country and remain unsettled, to lawyers.","hero":{"kind":"plate","image":null,"alt":null,"caption":null},"blocks":[{"t":"h2","id":"context-makes-copies-and-copies-outlive-the-window","runs":[{"text":"Context makes copies, and copies outlive the window"}]},{"t":"p","runs":[{"text":"A context window is transient. The infrastructure around it is not. By the time a user’s sentence has been through a typical pipeline, it exists in more places than anybody has counted:"}]},{"t":"ul","items":[[{"text":"The conversation store."}],[{"text":"The assembled-request log, if you log the rendered prompt, which the measurement module will recommend."}],[{"text":"The trace or observability system."}],[{"text":"The vector index, as an embedding, plus the chunk text stored beside it."}],[{"text":"The keyword index."}],[{"text":"The retrieval cache and any response cache."}],[{"text":"The memory store."}],[{"text":"An evaluation set somebody built from real conversations."}],[{"text":"The provider’s own retention, for whatever period their terms state."}],[{"text":"Your database backups, for their retention period."}]]},{"t":"p","runs":[{"text":"Ten places. A deletion request that reaches two of them has not deleted anything; it has made the data harder to find while leaving it there."}]},{"t":"h2","id":"write-the-inventory-before-you-need-it","runs":[{"text":"Write the inventory before you need it"}]},{"t":"p","runs":[{"text":"The single most useful artefact here is a list: every store that can contain user text, who owns it, what its retention is, and how deletion is performed on it."}]},{"t":"p","runs":[{"text":"Write it now, while there are six entries. It is a page. Writing it during an incident or a regulator’s enquiry, when there are eleven entries and two of them are somebody’s notebook, is a different exercise entirely."}]},{"t":"p","runs":[{"text":"And give each entry a retention period chosen on purpose. “Forever, because nobody set one” is the default and it is the wrong answer for every store on that list except possibly the transcript."}]},{"t":"h2","id":"deletion-has-to-be-a-tested-operation","runs":[{"text":"Deletion has to be a tested operation"}]},{"t":"p","runs":[{"text":"Treat it like any other critical path: it needs a function, a test, and an assertion."}]},{"t":"code","lang":"python","label":"Python","text":"def erase_user(user_id):\n    for store in ALL_STORES:          # the inventory, as code\n        store.delete_for_user(user_id)\n    for store in ALL_STORES:\n        assert store.count_for_user(user_id) == 0, store.name"},{"t":"p","runs":[{"text":"Having "},{"text":"ALL_STORES","code":true},{"text":" as a list in code, rather than as a paragraph in a document, is what stops the eleventh store from being forgotten when somebody adds it in March. A new store that is not in the list fails the test."}]},{"t":"p","runs":[{"text":"The assertion matters more than the deletion. Plenty of systems have a delete path that silently misses a store, and nobody notices, because a successful deletion looks exactly like a deletion that did nothing."}]},{"t":"h2","id":"the-parts-that-are-hard","runs":[{"text":"The parts that are hard"}]},{"t":"p","runs":[{"text":"Three honest difficulties, none of which has a tidy answer."}]},{"t":"p","runs":[{"text":"Embeddings.","b":true},{"text":" A vector derived from a sentence is not the sentence, but it is derived from it, and research on inverting embeddings back into approximate text has shown it is far more feasible than most people assumed. Treat vectors as personal data and delete them with everything else, rather than arguing that they are anonymous."}]},{"t":"p","runs":[{"text":"Derived artefacts.","b":true},{"text":" A summary, a memory entry, a generated chunk context, a fine-tuning dataset. Each contains the user’s information in transformed form. The summary is deletable; a model trained on the data is not, in any practical sense, which is a strong argument for not training on production conversations without a clear basis and a clear consent path."}]},{"t":"p","runs":[{"text":"Backups.","b":true},{"text":" You cannot selectively delete from an immutable snapshot. The common practice is a documented backup retention window after which the data ages out, plus a suppression list so restored data is re-deleted. Whether that satisfies a given regulator is exactly the kind of question that needs a lawyer rather than an engineer."}]},{"t":"h2","id":"the-law","runs":[{"text":"The law"}]},{"t":"p","runs":[{"text":"Rights to erasure and correction exist in the EU’s GDPR, India’s DPDP Act, California’s regime and many others. They are broadly similar in shape and differ in the details that matter: what counts as personal data, which exceptions apply, how long you have, whether inferred data is covered, and what a legal-obligation exception permits you to retain."}]},{"t":"p","runs":[{"text":"The application of all of this to AI systems is actively contested and moving. There are open questions (about training data, about model weights as a form of retention, about automated inference) where practitioners, regulators and courts do not yet agree, and where the answer differs by country."}]},{"t":"p","runs":[{"text":"So this lesson does not tell you what the law requires of you, and could not. It tells you what to build so that whatever your lawyers conclude is implementable: an inventory, a per-store retention period, a tested erase function, and no derived artefact whose provenance you cannot trace."}]},{"t":"h2","id":"forgetting-as-a-feature","runs":[{"text":"Forgetting as a feature"}]},{"t":"p","runs":[{"text":"One last framing, because it is more useful than the compliance one. A user asking “forget that” is asking for a product behaviour, not filing a legal request. Support it directly: a delete button next to each memory, a way to clear a conversation, an ephemeral mode that retains nothing."}]},{"t":"p","runs":[{"text":"Systems that make forgetting easy get used more freely, because a user who cannot delete something learns to be careful about what they say. That caution costs you the context that would have made the product work."}]}],"check":{"question":[{"text":"A team implements deletion across the conversation store and the memory store, and considers the requirement met. What is the most likely gap?"}],"options":[{"text":[{"text":"Backups retain the data until their retention window expires, which no code path can shorten."}],"correct":false,"tempting":[{"text":"A genuine and well-known difficulty, but it is usually the one teams have already thought about."}]},{"text":[{"text":"Derived copies (the vector index, prompt logs, traces, caches and evaluation sets) still contain the same text."}],"correct":true,"tempting":null},{"text":[{"text":"The provider’s retention period means the data persists outside the team’s systems."}],"correct":false,"tempting":[{"text":"True and worth knowing, but it is contractual rather than something the deletion path can address."}]},{"text":[{"text":"Embeddings are not personal data, so they are correctly excluded from deletion."}],"correct":false,"tempting":[{"text":"States a conclusion that inversion research undermines; vectors derived from text should be deleted with it."}]}],"order":[3,2,1,0],"why":null},"prev":{"slug":"the-handover-note","title":"Passing context to whoever comes next","minutes":8},"next":{"slug":"telling-the-user-it-forgot","title":"Being honest about a bounded window","minutes":8}}}