ChatGPT Pro costs $200 a month. That figure tends to dominate the conversation: higher usage limits, deeper reasoning models, Sora, agent mode, Codex. Privacy usually comes up later, right after you’ve pasted a client contract or a customer complaint into the box and paused to wonder who else can read it.
I went through the settings, the policy documents, and the specific data terms attached to the Pro tier. The short version is uncomfortable: Pro buys capability, not confidentiality. The data handling that applies to a $200 consumer subscription is largely the same handling that applies to the free account you made two years ago.
Why the price tag creates a false sense of protection
There’s a reasonable assumption that a premium tier comes with premium handling. Enterprise procurement works that way. Consumer subscriptions don’t. ChatGPT Pro is a personal plan. It runs under OpenAI’s consumer terms, and it does not come with a data processing agreement, an admin console, zero-retention guarantees, or a named support contact for compliance questions.
Two ideas get blurred constantly here. Security is about whether someone can break in. Privacy is about what happens to your data once it’s already inside. Someone asking about encryption and SSO is asking a security question. Someone asking whether their quarterly forecast gets used to improve a model is asking a privacy one.
If the security side is what you’re weighing up, that’s a separate analysis and the breakdown of what ChatGPT Pro’s $200 tier actually protects handles it properly. This piece stays on data.
The three settings that change your real exposure
1. The training toggle
Under Settings, then Data Controls, there’s a switch labelled roughly as improving the model for everyone. Leave it on and new conversations can be used to train future models. Turn it off and they aren’t. That’s the single highest-leverage click in the entire account, and it’s buried three levels deep.
Two caveats worth knowing. It isn’t retroactive, so anything you shared before the switch stays in whatever training pipeline it already entered. And it doesn’t stop OpenAI from storing chats for its own operational purposes, which is a different thing from training.
2. Temporary Chat
Temporary Chat sits outside your history, doesn’t build memories, and doesn’t feed training. It also doesn’t carry your custom instructions, which is why the answers feel oddly generic the first time you use it.
What it isn’t is anonymous. Your account is still identified, and OpenAI’s documentation notes that temporary chats can be retained for up to 30 days for abuse monitoring before deletion. If a lawful request arrives in that window, a temporary chat is still a chat that exists.
3. Memory
Memory is the feature most people forget they enabled. It quietly accumulates facts across conversations: your job title, your kids’ names, the name of the client you complained about in March. You can review the whole list and delete individual entries. Do that quarterly. It’s stored server-side until you clear it, and it follows you across devices and sessions.
Connectors and agent mode are where the risk actually lives
Most privacy discussions stop at the chat box. The chat box is the tame part.
ChatGPT Pro can connect to Google Drive, Dropbox, SharePoint and GitHub, and agent mode can take actions on your behalf across those services. That’s a genuine productivity gain and a genuinely bigger surface. Once a model has read access to a shared drive, the question stops being “what did I type” and becomes “what could it reach.”
Prompt injection is the specific worry. A hidden instruction tucked into a document, an email signature, or a comment thread can steer an agent that has tool access. Researchers have demonstrated this repeatedly across every major assistant. Permissions matter more than prompts: if you connect a drive, connect the folder, not the org.
Audit connected apps every couple of months. Settings, then Connectors. Revoke anything you don’t recognise or no longer use.
How long your data sticks around
Deleted chats aren’t gone instantly. OpenAI’s help documentation describes a deletion window of up to 30 days before conversations are removed from its systems, and longer if content has been flagged or is subject to a legal hold. Backups follow their own cycles.
Practically, that means hitting delete on a sensitive thread is a request, not an erasure. Treat it as “gone soon” rather than “gone now.” For most personal use that’s fine. For anything under an NDA, it’s the detail that decides whether you use the tool at all.
Pro versus Plus, Team and Enterprise on data terms
This is where the price ladder stops matching the privacy ladder. The higher tiers with real data commitments aren’t the expensive personal one.
- Free and Pro: consumer terms. Training is opt-out, retention runs on the standard consumer schedule, no DPA, no admin layer.
- Plus: same consumer framework, lower limits. The ChatGPT Plus business review digs into why $20 per seat still isn’t a business data arrangement.
- Team: business terms, training excluded by default, an admin console, seat management. Priced per seat and modest compared to Pro.
- Enterprise: the DPA, configurable retention, compliance documentation, and the option of zero data retention for API workloads.
The awkward takeaway: if confidentiality is your reason for upgrading, $200 of Pro gets you less protection than a couple of Team seats.
A ten-minute check you can run tonight
Open settings and work down this list.
- Turn off model training under Data Controls.
- Read your memory entries and delete anything you wouldn’t put in a shared doc.
- Review connected apps and remove stale ones.
- Export your data once, skim the archive, then decide what to clean.
- Set a personal rule for Temporary Chat, such as “anything with a real name in it.”
That sequence takes about ten minutes and changes your exposure more than any upgrade decision. If you want a broader checklist for evaluating unfamiliar tools before you hand over an account, the privacy review most people skip before signing up is worth reading alongside it.
The verdict: Pro is a throughput purchase, not a privacy one
After weeks on the tier, my read is that Pro earns its money through limits and model access, not through data handling. If you’re generating long documents daily, running agent tasks, or leaning on the reasoning models for code, the $200 can make sense. The honest pros and cons from daily use lays out where the value stacks up.
What it doesn’t buy is a bubble around your information. The training switch, the connector permissions, and the memory list are identical in spirit across tiers, and they’re all on you to manage. Anyone treating the subscription price as a proxy for data protection is one confidential paste away from an uncomfortable conversation with their legal team.
If confidentiality sits at the centre of your work, the sequence is straightforward: Team or Enterprise for the contract, Pro for the horsepower if you still want it, and Temporary Chat for the edge cases. If you’d rather not pay at all, know that free tiers trade your data for access far more readily than paid ones do, so the settings audit matters even more there.
Pro is a good tool with ordinary consumer privacy terms attached. Buy it for the reasoning limits. Just don’t buy it expecting the fine print to be different.