Accounts, sharing and devices

Who else can see your conversations

Four routes, and most people have thought about none of them.

The person holding the device. A shared family phone or a household computer shows conversation history to whoever opens the app. For someone asking about health, money, immigration status, an abusive relationship or their sexuality, this is a serious matter and it is invisible in every article about choosing AI tools. The answers are a private browsing window, deleting conversations, a device passcode, or a separate account the device does not stay signed into.

Your employer. If you use a work account, on a work device, or through your organisation’s single sign-on, an administrator can typically see that you used it and often what you sent. That is normal corporate practice, not surveillance, and it is stated in the policy you accepted. It means work accounts are for work.

Browser sync. Signed into a browser that syncs across devices, your history and sometimes your open tabs appear on other machines you own, including the one at the office, or the family desktop.

Anyone you share a link with. Sharing a conversation usually creates a public or unlisted URL, and public conversation links have been indexed by search engines when a product made sharing more open than users expected. Assume a shared link is a published document.

Work and personal, kept apart

The rule is dull and it prevents a lot of trouble: one account for work, one for personal, and never the same browser profile.

The reason is not only privacy. Memory features build a picture from your conversations and apply it to later ones, so an assistant that has learned about your job will bring that context into a personal question and the other way round. Separate profiles keep the two apart cleanly.

If your employer provides a tool, use it for work. It is covered by their agreement, which is better than your consumer terms, and it puts the responsibility where it belongs.

Memory, and what it does with the past

Products increasingly remember across conversations: facts about you, preferences, ongoing projects. It is useful and it has three consequences worth knowing:

It leaks between contexts. Something mentioned in one conversation appears in another, including one you are showing to somebody.

It is editable, and worth editing. There is a memory management page. Open it once; most people find something they would rather was not there, and something recorded wrongly that has been quietly shaping answers.

It is another copy of your information. Stored, retained, exported, and subject to the same policies as everything else.

If you are about to share your screen, or hand the device to a colleague, turn memory off or use a temporary chat. Most products have a mode that does not save.

Sharing an account, and why not to

Sharing a subscription is against most terms of service for simultaneous use, and the terms are the smaller problem. The real ones: everybody sees everybody’s history, memory blends several people into one incoherent picture, a security event affects all of you, and there is no way to remove one person’s access without changing the password for everyone.

Where cost is the reason, and it often is, the better answers are a team plan with separate seats, the API with a key per person, free tiers used deliberately, or a local model. All of them keep the histories apart, which is the part that actually matters.

Temporary chats, and what they do

Most products now offer a mode variously called temporary, incognito or “do not save”. It keeps the conversation out of your history and usually out of memory, which is the right tool for a question you would rather not have appear on a shared screen later.

Read what it claims carefully, because the two halves differ. Not saving to your history is a visible, verifiable behaviour. Not retaining it at all on the provider’s side is a separate promise, and several products still keep temporary conversations for a period for safety monitoring. It removes the risk from the person holding your device, which is the one it was designed for, and it is not the same as the material never having been sent.

The two-minute audit

Once, open the account page and check: which devices are signed in, which apps and integrations have access, what memory holds, whether any conversations are shared publicly, and whether the account has two-factor authentication. Remove what you do not recognise.

Most people doing this for the first time find at least one thing to revoke. It is the same audit you would do on any account holding years of your correspondence, which is exactly what this is.