ChatGPT Computer History Records Clicks And Typing. What Happens To The Data?
ChatGPT Computer History can log clicks, typing, and app activity. Here is what stays local, what reaches OpenAI, and what users should check.
ChatGPT Computer History can record interaction events such as clicks, typing, keyboard shortcuts, app switches, and macOS accessibility context from apps and websites you allow. It is not a continuous screenshot, screen-recording, microphone, or system-audio feature. But “no screenshots” does not mean “nothing sensitive leaves the Mac.” OpenAI says temporary events are processed on its servers to create memories, while the resulting plain-text memory files remain locally until you delete them.
The practical answer is to treat Computer History as a broad context pipeline, not merely a productivity timeline. Before enabling it, decide which sources may contribute, what can reach OpenAI for processing, how long local artifacts remain, which training controls apply later, and what an agent can do if hostile text enters that history.
What Is Confirmed
OpenAI's official Computer History documentation describes an opt-in feature for the ChatGPT desktop app on macOS. It is off by default for eligible ChatGPT Pro, Business, and Enterprise users. Business and Enterprise administrators must grant access before an individual member can choose to turn it on. The feature requires Memories and is not currently available in the European Economic Area, Switzerland, or the United Kingdom.
Once enabled, Computer History can build an interaction-event stream from permitted apps and websites. OpenAI lists these examples:
- clicks;
- typing;
- keyboard shortcuts;
- app switches; and
- context exposed through the macOS accessibility system.
OpenAI separately says the feature does not capture screenshots, screen recordings, microphone input, or system audio. Private-mode web browsing is excluded. The August 14 ChatGPT release notes repeat those boundaries.
The event stream is temporarily stored on the Mac. OpenAI says ChatGPT and Codex delete temporary event files after up to 48 hours. Periodically, an ephemeral Codex session processes those events on OpenAI's servers to generate summaries and memories. OpenAI says it does not retain the event files after that processing unless legally required and does not use the event files for training.
The generated memories return to the Mac as plain-text Markdown files. They remain on the filesystem until the user deletes or clears them. OpenAI says Computer History does not encrypt those files itself and warns that other programs running as the same macOS user may be able to access them.
There is also a second training boundary. OpenAI says that when ChatGPT or Codex later uses a memory, relevant memory content and interaction events may enter the context of a future chat. The use of that chat content for model improvement then follows the user's ChatGPT data controls. OpenAI's broader model-improvement documentation says consumer ChatGPT and Codex content may be used for training unless the user opts out, while Business and Enterprise inputs and outputs are not used for training by default.
Finally, OpenAI explicitly warns that Computer History increases prompt-injection risk from content in apps and websites. A malicious instruction on a page could become context that ChatGPT or Codex later encounters.
What Is Still Unclear
The documentation gives strong architectural boundaries, but it does not answer every operational question a privacy-conscious user or administrator may have.
It does not provide a complete schema for every interaction-event field. “Typing” and “accessibility context” can cover very different levels of detail depending on the app, the element, and what macOS makes available. The documentation does not publish a field-by-field inventory showing exactly when raw keystrokes, entered text, field labels, window titles, URLs, document names, or surrounding interface text are included.
It also does not establish that every supported app exposes the same information. A code editor, browser, terminal, messaging app, health portal, and password manager present very different data surfaces. An allow rule for an app is therefore not the same as a guarantee that only harmless metadata will be collected from it.
The sources reviewed do not provide an independent security audit of the local memory directory, the summarization pipeline, prompt-injection defenses, or deletion behavior. OpenAI documents what the feature is intended to do; that is not the same as third-party proof that every build and edge case behaves perfectly.
It is also unclear how much sensitive context a generated summary might preserve after the temporary event file is deleted. A 48-hour raw-event limit does not create a 48-hour limit for the resulting memory. The memory file can remain until the user clears it, and useful summaries can still reveal project names, customer details, document subjects, contacts, or work patterns without reproducing every underlying event.
These uncertainties are reasons to test the feature narrowly. They are not evidence that Computer History secretly records audio or screenshots contrary to the documentation.
Computer History Is Not A Screen Recorder, But It Can Still Be Sensitive
The most important distinction is between pixels and meaning.
A screenshot-based history captures what appeared on screen as an image. Computer History instead collects interaction events and accessibility context, then turns them into text summaries and memories. That reduces some risks. A stray photo, video frame, notification, or background window is less likely to be copied merely because it was visible in a screenshot.
But text-oriented capture can still reveal the substance of work. Consider what these events may imply:
| Event or context | What it could reveal |
|---|---|
| App switches | Which tools, customers, or projects were active |
| Window or document context | File names, page titles, case names, or task subjects |
| Typing events | Search terms, commands, draft text, or form input, depending on the surface |
| Clicks and shortcuts | The sequence of a workflow or the action a user selected |
| Accessibility context | Labels, controls, and readable interface content exposed by an app |
| Generated memory | A durable summary connecting several otherwise separate events |
That is why “it does not take screenshots” is an incomplete privacy answer. The real question is whether the captured events and derived memories expose information you would not want in a local text file or sent to a hosted processor.
The Data Flow Has Four Different Boundaries
Computer History is easier to reason about when the word “history” is split into distinct artifacts.
1. The source activity
This is what happens in an allowed app or website: browsing a page, editing a document, switching windows, entering text, or using a shortcut. Source controls determine what may contribute to future history.
2. Temporary interaction events
The Mac stores event files temporarily. OpenAI says they are isolated within the ChatGPT App Group and deleted after up to 48 hours. App Group isolation is a meaningful control, but the user must still trust the ChatGPT app, the macOS account, and software that has sufficiently broad permissions.
3. Hosted summarization
An ephemeral Codex session sends the temporary events to OpenAI for processing into memories. This is the crucial local-versus-hosted boundary: capture begins locally, but memory creation is not described as fully offline.
4. Persistent local memories and later chat context
The generated Markdown files stay on the Mac until deleted. They are readable and editable, which makes them inspectable, but Computer History does not encrypt them. When a relevant memory is used later, its contents and related events can become part of a ChatGPT or Codex request and follow the training setting that applies to that chat.
Deletion and training therefore cannot be reduced to one toggle. Deleting an event, deleting a generated memory, turning off future collection, controlling whether memories participate in a chat, and opting out of model improvement address different copies and future uses.
Does OpenAI Train On Computer History?
The accurate answer has two layers.
OpenAI says temporary Computer History event files used to generate memories are not used for training. That is a specific promise about those event files in the memory-generation pipeline.
OpenAI also says relevant memory contents and interaction events may later be included as context when ChatGPT or Codex uses a memory. That later chat content may be used to improve models if the user's data controls allow it. For consumer accounts, OpenAI's general policy says new ChatGPT and Codex conversations may be used for training unless the user opts out. Business and Enterprise content is excluded from training by default unless the organization explicitly opts in.
So “Computer History is never used for training” is too broad. A better statement is:
OpenAI says the temporary event files used to create Computer History memories are not training data, but memory-derived content used in a later consumer chat can follow that chat's model-improvement setting.
Users who do not want future memory-assisted conversations used for model improvement should review both ChatGPT data controls and any separate Codex environment controls. OpenAI notes that changing ChatGPT's training setting does not automatically change Codex's separate control for full environments.
The Plain-Text Memory Tradeoff
Saving generated memories as Markdown has a real advantage: users can inspect what the system retained instead of trusting an invisible database. They can reveal the file in Finder, read it, modify it, and delete the corresponding timeline item.
The tradeoff is that readable files need ordinary endpoint protection. OpenAI warns that the files may contain sensitive information and are not encrypted by Computer History itself. Other programs running under the same macOS account may be able to read them.
That does not necessarily mean the Mac's disk is unencrypted. Apple says Macs with Apple silicon or a T2 Security Chip encrypt data automatically, and FileVault adds protection against access without the login password. But full-disk encryption primarily protects data at rest when the machine is locked or stolen. It does not stop authorized software running inside an unlocked user session from reading files that user can access.
The useful security questions are therefore:
- Is FileVault enabled and is the recovery key protected?
- Is the Mac account shared with anyone else?
- Which apps run under that account?
- Which apps have Full Disk Access, Accessibility, automation, or developer permissions?
- Are local memory directories copied into cloud backup, endpoint monitoring, or synchronization tools?
- Do corporate retention or discovery rules apply to those copies?
“Stored locally” describes a location. It does not by itself prove confidentiality, encryption at every layer, or freedom from backups.
Why Prompt Injection Matters Here
Computer History can transform untrusted external text into future agent context. That is a classic setup for indirect prompt injection.
Imagine that an allowed browser visits a page containing text that looks like an instruction to an AI agent. A human may ignore it or never notice hidden styling. Computer History can still summarize activity around that page. Later, ChatGPT or Codex may use the history to identify the source or continue the workflow. OpenAI warns that the model might follow malicious instructions from such content.
This does not mean a prompt injection automatically controls the Mac. Consequences depend on what context reaches the model, what the model follows, which tools are available, what sandbox applies, and which actions require approval. But broader memory increases the number of untrusted sources that can influence a future task.
The safest configuration keeps observation and authority separate. A system that remembers many apps should not automatically gain broad write, shell, browser, email, or cloud-file permissions merely because more context makes those actions convenient.
Use The SCOPE Audit Before Enabling It
A short SCOPE audit makes the privacy decision concrete.
S — Sources
Start with Include only rules. Select the smallest set of apps and websites needed for one useful workflow. Exclude password managers, personal email, messaging, health portals, banking, customer databases, production consoles, and any source containing secrets unless there is a specific justified need.
C — Capture
Run a harmless test and inspect the resulting timeline and Markdown memory. Use distinctive fake document names and non-sensitive sample text so you can see which details survive. Do not test with real credentials, health information, financial records, or customer data.
O — Off-device processing
Confirm that stakeholders understand the pipeline. Events originate and remain temporarily on the Mac, but OpenAI processes them on hosted servers to generate memories. Do not describe the feature as fully offline.
P — Persistence and protection
Review the 48-hour event window, the indefinite local-memory lifetime, backups, synchronization, endpoint tools, FileVault, account sharing, and deletion procedures. Verify that clearing an item removes both relevant events and generated memories as the product documentation says.
E — Execution authority
Review what ChatGPT or Codex can do after history becomes context. Keep sandboxing, approval prompts, network limits, connector permissions, and write access as narrow as the task allows. Treat memory as untrusted input, not as a privileged instruction channel.
Who This Is For
Computer History is most useful for people whose work is fragmented across many documents, apps, tabs, conversations, and recurring sequences. Developers, project managers, researchers, and operations teams may gain real value from asking what they were doing before a break or turning a repeated workflow into an automation.
It is a poor default for anyone who cannot clearly separate work sources from sensitive personal, regulated, privileged, or third-party information. It also deserves extra review on shared Macs, managed endpoints, machines with broad developer tooling, and accounts where local files are automatically synchronized or backed up.
For organizations, administrator permission is only one layer. OpenAI's design still requires each person to opt in, and its documentation advises turning the feature off during communications with other people unless they have given prior express consent. Policy, notice, consent, acceptable-use rules, endpoint controls, and incident response should be settled before a broad rollout.
What This Does Not Mean
The documented feature is not proof that ChatGPT continuously screenshots every Mac. It does not capture screen recordings, microphone input, or system audio, and private-mode browser activity is excluded.
It is also not proof of a breach, secret keylogger, or unauthorized rollout. Computer History is opt-in for eligible users, and Business or Enterprise access requires an administrator to make it available before a user can opt in.
Conversely, local memory does not mean the workflow is fully local. Temporary events are processed by OpenAI to generate memories. “Not used for training” applies specifically to those temporary event files; later memory-assisted chat context follows the applicable data controls.
Where OpenVeil Fits
OpenVeil is relevant when the user's real need is a narrower privacy-focused AI workspace rather than a cross-app computer-activity timeline. Its normal chat history is browser-local, and OpenVeil does not keep a normal server-side chat-history record for those private chat sessions. OpenVeil also documents that prompts, uploads, media, and outputs are not used to train foundation models.
That is a different product boundary, not a universal security claim. OpenVeil is hosted. Active prompts, uploads, searches, voice, images, video, and other requests still require processing by OpenVeil and necessary providers. OpenVeil does not claim to be fully offline, anonymous, a macOS endpoint-security tool, or protection against prompt injection in unrelated products.
If you do not need an assistant to remember activity across every permitted app and website, reducing the scope of observation can be more valuable than trying to harden an unnecessarily broad history. If you do need Computer History, OpenVeil does not replace its workflow automation or local endpoint controls.
Frequently Asked Questions
Does ChatGPT Computer History record everything I type?
OpenAI says interaction events can include typing, but its public documentation does not provide a field-by-field schema proving that every keystroke or every text field is captured. The amount of context can vary by app and what macOS exposes. Test with harmless sample data and inspect the generated history before trusting a source with sensitive input.
Does Computer History take screenshots?
No, according to OpenAI's current documentation. It records interaction events and does not capture screenshots, screen recordings, microphone input, or system audio. It replaces the earlier Chronicle preview, which used screenshots, but OpenAI describes Computer History as a rebuilt system.
Is ChatGPT Computer History stored locally?
Parts of it are. Temporary event files and generated Markdown memories are stored on the Mac. OpenAI also processes temporary event files on its servers to create memories, so the complete workflow is not fully local or offline.
How long does ChatGPT keep Computer History?
OpenAI says temporary event files are deleted after up to 48 hours. Generated memory files remain on the Mac until the user deletes or clears them. Those are separate retention periods for separate artifacts.
Are Computer History memories encrypted?
OpenAI says Computer History does not encrypt its plain-text Markdown memory files itself. macOS disk encryption such as FileVault can protect data at rest, but software running as the same logged-in user may still be able to read accessible files.
Can I stop or delete Computer History?
Yes. OpenAI says users can pause or resume collection, turn the feature off, delete individual timeline items, clear the last 10 minutes, hour, day, or all history, and clear the last session for a recent app. Changing source permissions affects future history; existing items must be deleted or cleared separately.
Does deleting Computer History turn off ChatGPT Memory?
Not necessarily. Computer History requires Memories, but they are distinct controls. Clearing Computer History deletes the relevant events and memories created from them. Other saved memories, chat history, files, and connected sources can have their own controls and lifecycles.
Can a website prompt-inject ChatGPT through Computer History?
OpenAI says the feature increases prompt-injection risk and gives the example of malicious instructions on a website influencing ChatGPT or Codex. Whether an attack succeeds or causes harm depends on model behavior, source context, tool access, sandboxing, and approval requirements.
Bottom Line
ChatGPT Computer History is more privacy-conscious than a continuous screenshot recorder in several important ways: it is opt-in, excludes private browsing, avoids screen and audio capture, offers source controls, and makes generated memories inspectable. But it still observes broad interaction events, processes temporary event files on OpenAI's servers, leaves durable plain-text memories on the Mac, and can carry untrusted content into future agent context.
The safest decision is not “on” or “off” in the abstract. It is a narrow, testable configuration: allow only necessary sources, inspect what becomes memory, understand the hosted processing step, protect and delete local artifacts, review training controls, and keep agent authority separate from what the history observes.