Three You Can Take Back. One You Can't.

Someone assumes they can just delete what they told an AI. That is the wrong question to ask, because there is not one place that detail goes, there are four, and only three of them let you take it back.

Four places, not one

Take a single sentence containing three ordinary facts: you have a partner, they hike, you live near Denver. None of it is alarming on its own, but together it is enough to place you roughly on a map. That sentence does not go to one destination. It lands in four places at once, stacked on top of each other, and each level down keeps less of what you said while keeping it for longer. This four-level breakdown borrows a taxonomy that Anthropic's education team laid out, and the framing is correct as far as it goes. What it does not draw out on its own is the axis that actually determines how careful you should be: not where the data goes, but which of these places you can walk back out of.

Level one: the conversation itself

The first level is the conversation itself. While the chat window is open, the model is working with whatever you have told it. When you close that window, it is not quietly holding onto those facts somewhere else, because it was never storing them anywhere beyond the conversation to begin with. Open a new chat tomorrow and it starts blank. The model has no idea your partner hikes and no way to find out unless you tell it again. This door swings both ways at no cost. Close the tab, and the detail is gone from the only place it was ever living. The overwhelming majority of what people type into an AI never goes further than this.

Level two: product memory

The second level is where the language around "memory" gets loose, and it is worth being precise about the mechanism rather than the marketing. The model itself did not remember you. A file attached to your account did, and that file gets read back into a fresh chat before you finish typing your first word. That distinction matters because a memory you can open is a memory you can edit. In most products, you can read that file, change a line in it, clear it entirely, or switch the feature off. This door still swings both ways, but someone else set the latch before you arrived, memory may be on by default or waiting for you to switch it on, and that is a setting worth checking rather than assuming.

Level three: provider systems

The third level is not the model at all. It is the provider's own operational machinery: keeping the service running, reviewing for abuse, fixing bugs, doing research, and in some cases supporting commercial uses. Your facts sit inside that machinery for a retention period that is real and usually written down somewhere, but it is not a period you set yourself. This door still opens both ways, technically, past a clock you do not wind. You can request deletion, but you do not control the interval. This is the first level where being "in control" stops meaning you can undo something immediately and starts meaning you can file a request and wait for it to take effect.

Level four: training

The fourth level is training, and it is the one that does not swing back open. Some providers use conversations to improve future models. Personal details are generally stripped out first, and that hedge, "generally," belongs to the provider, not to any guarantee you can rely on. Once a conversation is used this way, your sentence stops being a sentence and becomes a tiny statistical adjustment to how likely certain words are to follow other words. Nobody can read your original words back out of a trained model, which is a genuine form of reassurance. But it is also the one door that does not open backward: you cannot untrain a model on a conversation it has already learned from. Where providers do train on conversations, most offer an opt-out toggle, and it is worth finding it, but understand what it actually buys you. It protects every conversation after you flip it. It does nothing for any conversation before.

Pricing the worst case

Four levels, three reversible doors, one that is not. That gives you a simple rule: price what you share against the least reversible place it could end up, not the place it is most likely to end up. Most of what you type never leaves level one, but deciding as though it might is the safer habit, and it costs nothing. If a tool does not actually need someone's real name to do its job, do not give it the real name. A placeholder works exactly as well when you are just asking for help rewording an email.

Key takeaways

• Data you share with an AI lands in four stacked places: the conversation, product memory, provider systems, and training.
• The conversation itself and product memory are both fully reversible, close the tab or edit and clear the memory file.
• Provider systems hold data on a retention period you can request deletion against but cannot directly control.
• Training is the one level that does not reverse; you cannot untrain a model on a conversation it has already learned from.
• Opt-outs from training are forward-looking only, they protect future conversations, not past ones.
• The right question to ask is which of the four levels you could reverse tomorrow, not where the data technically lives.

Try it yourself

Open the privacy and data settings for the AI tool you use most and check four specific things: whether it keeps conversation history, whether it has a memory feature and whether it is switched on, what retention period it states, and whether training on your conversations is on or off. Then ask yourself which of those four you could reverse tomorrow, and which one you could not, that last question is the whole exercise, and it takes about five minutes to run against your own account. This walkthrough is part of the Claude Basics series from Humanitarians AI, aimed at giving people a clear, mechanism-level understanding of how their everyday AI tools actually handle their data.