What happens to what you type

Three different questions

Students collapse three separate things into one worry. Separating them makes each answerable.

Is it stored? Almost always yes, for some period. Providers retain conversations for abuse monitoring and service operation even when you delete them from your view. Retention periods are stated in the privacy policy and typically run to some number of days after deletion.

Is it used for training? This is the one you can usually control. Consumer free tiers commonly train on input by default with an opt-out; paid business, enterprise and education tiers commonly do not, by contract. The setting is in data controls and is worth finding once.

Can a human read it? Sometimes, in limited circumstances: samples reviewed for safety, investigations of abuse, legal process. Not routinely, and not casually.

Your institution’s account

If your university provides a tool, the contract usually prohibits training on your input and places the data under an agreement the institution has assessed. That is a real advantage and it is often a paid tier at no cost to you.

The trade-off: logs exist and are accessible to the institution under its own procedures. Administrators are not reading your conversations for entertainment, and in an investigation the records may be available. Treat an institutional account as a work account, because that is what it is.

What a school or university can see anyway

Broader than most students assume, and worth knowing accurately rather than fearing vaguely:

• On their network, traffic to and from your device is visible in outline, and on a managed device more than that.
• On a managed laptop or Chromebook issued by the institution, potentially a great deal, including installed monitoring.
• In their systems (the virtual learning environment, submission platform, email) everything, and it is retained.
• Submission platforms store your work and compare it against their databases, which is what they exist for.

On your own device on your own connection, they see essentially nothing.

Age, and school students

If you are under 18, additional protections apply and additional restrictions come with them. Most providers set minimum ages, often 13 with parental consent up to 18, and school-provided tools usually run under stricter configurations with filtering and logging. Data protection law in many countries (GDPR in Europe and the UK, COPPA in the United States, and equivalents elsewhere) treats children’s data more restrictively.

The practical version for a school student: use the tool your school provides if there is one, assume anything typed into a school account is visible to the school, and do not put personal details about yourself or your friends into any of it.

Your own data, and the settings pass

Once per tool, ten minutes:

1. Data controls. Find the training toggle. Decide.
2. History and retention. Learn what deleting does and how long anything persists.
3. Memory. Read what it has stored about you. People are regularly surprised, and it is editable.
4. Connected apps and integrations. Anything with access to your email, files or calendar: check what you granted and remove what you do not use.
5. Export. Most providers let you download everything they hold. Doing it once is instructive.

Rights you have

In many jurisdictions, data protection law gives you rights over your personal data: access to what is held, correction, deletion in some circumstances, and portability. The GDPR versions apply across the EU and UK; several other countries have similar regimes, India’s data protection legislation among them, and the details differ.

The practical point is that these are real and usable (a subject access request is a formal thing you can make of a provider or your institution) and that the specifics vary by country enough that this course is not going to summarise them into advice. Look up your own jurisdiction’s regime if you need to use it, and none of this is legal advice.

The habit that makes all of this simpler

The rule from Module 2, restated because it is the whole of the practical answer:

Would I mind if this appeared in a public archive with my name on it?

Settings are promises about handling. Companies change, are acquired, are breached, and are subject to legal process. The only content safe from all of that is content you did not type. So paste generously from published and your own material, keep other people’s information out entirely, and do the settings pass once so that the remaining risk is one you chose rather than one you never looked at.