What counts as metadata in an AI chat?

Everything recorded about a conversation other than the words in it: timestamps, session length, number of messages, regeneration counts, which model and mode you selected, token counts, file sizes and types, automatically generated conversation titles, safety classifier scores, and the account, device and billing records the request is attached to.

Is metadata really more revealing than content?

Not more revealing, but far easier to use at scale — it is already structured, so it sorts and correlates without anyone reading anything. A 2016 PNAS study inferred medical conditions, firearm ownership and reproductive health decisions from telephone metadata alone, and the EU Court of Justice held in Digital Rights Ireland that such data "taken as a whole" permits very precise conclusions about private life.

Does deleting a chat delete the metadata too?

Generally no. Deletion is a content operation. OpenAI removes deleted chats within 30 days but excepts de-identified data and anything held for security or legal obligations; Anthropic deletes from back-end storage within 30 days while retaining flagged inputs and outputs up to 2 years and trust-and-safety classification scores up to 7 years. Billing and usage records run on their own schedules.

Do my uploaded files leak metadata?

On most services, yes — and it is the most commonly missed one. Office documents carry author, "last modified by", company, revision history and tracked-change comments; PDFs carry producer and timestamps; photos carry EXIF including GPS coordinates. Redacting the visible text does not touch any of it. Strip it yourself with Word's Document Inspector or an EXIF tool, or send a screenshot instead of the file. On Secret Chat this is handled by default: every attached image has its EXIF stripped and every PDF has its document information fields blanked before the file goes to a model.

Can Secret Chat AI eliminate prompt metadata?

Not all of it — a request must arrive at some time, for some model, with some size, and no honest service can promise otherwise. What Secret Chat removes is the anchor it would attach to: providers receive your query through our gateway with no IP, device, account or payment identity of yours, so the metadata joins an aggregate stream instead of a file about you. Attachment metadata we do remove outright (EXIF from images, document info from PDFs). We do keep an anonymous device token and basic visit data, separate from your conversations.

What Your Prompts Reveal: The AI Metadata Problem

Published July 28, 2026 · Facts last verified July 28, 2026

Almost every argument about AI privacy is an argument about content. Will they train on my chats? Can a human read them? Does deleting the conversation really delete it? These are good questions, and the industry has learned to answer them — with toggles, retention windows, and enterprise agreements.

Meanwhile a second record is being written beside every conversation, and almost nobody asks about it. It is smaller, cheaper to store, easier to search, and in several documented cases it outlives the conversation by years. It is the envelope your prompt arrived in: when you asked, how often, from what, with which model, how long the answer took, how big the file was, what the safety classifier thought of it.

That is metadata. It is the half of the record that never appears in a privacy toggle, and it is worth understanding on its own terms.

Why Metadata Is the Easier Half to Use

The intuition that metadata is the harmless part is old, widespread, and wrong — and the people best positioned to know have said so plainly.

In a 2014 debate at Johns Hopkins University, former NSA and CIA director Michael Hayden agreed that metadata can tell you essentially everything about a person and added the line that has followed him since: "We kill people based on metadata." In fairness he immediately qualified it — "but that's not what we do with this metadata," referring to domestic collection. The qualifier matters. The admission underneath it matters more: the envelope was sufficient.

The Court of Justice of the European Union reached the same conclusion in law. Striking down the Data Retention Directive in Digital Rights Ireland (2014), the Court held that retained communications metadata, "taken as a whole, may allow very precise conclusions to be drawn concerning the private lives of the persons whose data has been retained, such as the habits of everyday life, permanent or temporary places of residence, daily or other movements, the activities carried out, the social relationships of those persons and the social environments frequented by them."

And it has been measured. In a 2016 PNAS study, Stanford researchers collected real telephone metadata — numbers, times, durations, no content whatsoever — from volunteers and tried to see what it gave up. It gave up a great deal. Automated analysis found that 57% of participants had called health services, 30% pharmacies, 8% religious organisations, 7% firearms dealers. Looking closer: 8% had contacted mental health providers, 6% sexual and reproductive health services, 1% oncology practices. Manual review of individual records produced confirmed inferences — one participant's pattern of calls to neurology practices, a chronic-care pharmacy and a multiple sclerosis medication hotline; another's sequence of calls to a cardiology group, a medical lab and a cardiac device support line, confirmed afterwards as an arrhythmia. The researchers had no idea what anyone said. They did not need to know.

The reason metadata punches above its weight is structural, not sinister. Content is unstructured: a million chat logs need a million acts of reading. Metadata is already a database: a million timestamps need one query. Content requires judgement to interpret; metadata sorts, joins, and correlates by itself. If you are going to keep something about a hundred million users, you keep the part that a machine can use.

1. Timing: When You Ask

Every message carries a timestamp, on both sides of the exchange. A single one says nothing. A few months of them describe a life.

Timestamps reveal your timezone without any location data — the gap in your activity is when you sleep, and it moves when you travel. They reveal your working hours, and therefore whether a given question was asked from work. They reveal your weekends, your holidays, your insomnia. Regularity is itself a signal: a burst of activity that starts at 23:00 and runs for three hours, six nights in a row, is a different story from the same number of prompts spread evenly across a fortnight.

And timing binds to subject matter. The question is not "does the provider know you asked about employment law?" — that is content. It is that the envelope alone records that something began on a particular Tuesday evening and continued nightly for two weeks, which is the shape of a crisis whether or not anyone reads a word of it.

2. Cadence: How Much, How Long, How Hard

Beyond when, there is how. Session length, messages per session, the interval between your question and your next one, how many times you regenerated an answer, how often you edited and resent, whether you abandoned the conversation mid-thread.

These are ordinary product analytics — every software company measures them, for entirely ordinary reasons. They are also a decent proxy for your state of mind. Twelve regenerations of the same request is frustration or high stakes. A long pause before a follow-up is someone reading carefully, or someone deciding. Short, fast, repetitive sessions look like work; long, meandering ones look like something else.

3. Model and Mode: What the Choice Declares

Modern AI products no longer have one model. They have tiers, and modes: fast chat, web search, deep research, image generation, reasoning effort. Every one of those selections is recorded, and every one is a small declaration of intent.

Reaching for a deep-research mode says the question was not casual. Escalating from a fast model to a heavier one says the first answer was not good enough, which says the problem was hard. Switching to image generation says something else entirely. None of this is content — it is a menu selection — and it is stored as a clean categorical field, which is exactly the format that aggregates well.

4. Size: Token Counts and Attachments

Usage accounting requires counting tokens, so token counts exist wherever billing or quotas exist. They are also a measurement of your input.

A forty-thousand-token prompt is a pasted document, and its size narrows what kind. Three files attached in one message is a bundle of evidence. A very long input followed by a very short output is a summarisation; the reverse is drafting. File counts, file sizes, and file types are structural facts about your material that survive independently of the material.

5. Titles: Content That Became Metadata

This one deserves separate attention because it crosses the line in an underappreciated way. Most chat products automatically generate a short title for each conversation so your sidebar is navigable — and that title is a model-written summary of what you discussed, stored as a compact, indexable string.

Functionally it lives in the metadata layer: short, structured, cheap to keep, cheap to search. Semantically it is content. "Divorce settlement — dividing the house" is not a timestamp. A list of a year's chat titles is a table of contents for a person's private life, and it fits in a few kilobytes.

6. Safety Scores: The Judgement That Outlives the Prompt

Every major provider runs automated classifiers over inputs and outputs to enforce its usage policy. That produces a score — a machine's assessment of your prompt across a set of risk categories — and the score is a separate record from the prompt.

Anthropic documents the consequence unusually clearly. Delete a conversation and it leaves your history immediately and back-end storage within 30 days. But where automated systems flagged a policy violation, Anthropic states it retains inputs and outputs "for up to 2 years and trust and safety classification scores for up to 7 years." De-identified data in model training pipelines may be kept up to 5 years; feedback submissions, 5 years.

Read that ordering again. The conversation: 30 days. The classifier's opinion about the conversation: up to seven years. This is not a scandal — abuse investigation genuinely needs a longer horizon than ordinary storage, and publishing the numbers is more than most companies do. But it is the clearest illustration available of the article's thesis: the derivative record outlives the original, and it is the derivative record that is already machine-readable.

7. The Metadata Inside Your Files

When you attach a document to a prompt, you send more than you can see on screen.

Microsoft's own guidance is explicit that Office files carry hidden data and personal information: author name, the "last modified by" name, company name, revision history, comments, tracked changes, and email addresses embedded in those changes — which is why Word ships a Document Inspector to strip them. PDFs carry a producer application, author field, and creation and modification timestamps. Photographs carry EXIF: camera model, serial number in some cases, exact capture time, and — unless it has been stripped — GPS coordinates.

The failure mode here is specific and common. Someone carefully redacts the names inside a contract, then uploads the file with the client's real firm still sitting in the "Company" property and their own full name in "Last modified by". The visible text was anonymised; the envelope was not.

This item differs from the rest of the list in one useful way: it is the one a service can actually fix on your behalf, because the metadata sits in a known place in a known format. Stripping it is a solved problem — the question is whether anyone does it for you by default, and mostly nobody does.

8. Account and Billing: The Anchor

Everything above is only as identifying as the identifier it hangs from — and the account is where identity actually enters.

Signing up produces an email address; many services require a phone number as an anti-abuse measure; the signup event records an IP and a device. Paying produces the strongest link of all: a cardholder's legal name and billing address, held by a payment processor and reconcilable to the account. Your prompts may be a mystery; your invoices are not.

This is also where the layers meet the device-level signals we covered separately — IP, browser fingerprint, storage identifiers. Metadata about your prompts and identifiers about your device are different families of data, but they join on the same key.

9. The Vendors You Never Chose

Product analytics are usually not built in-house. They are bought, and that means a third party holds a copy of the envelope.

The clearest recent demonstration is the November 2025 Mixpanel incident. An attacker exported a dataset from OpenAI's analytics vendor containing names, email addresses, approximate locations, browser and operating system details, referral information, and organisation or user IDs. Notably, no chat content was involved — no conversations, no API requests, no keys, no payment details. It was a pure metadata exposure, and it was serious enough to warrant notifying affected users worldwide.

That incident is the whole argument in miniature. The content was safe. The exposure still mattered.

Why Deletion Does Not Reach It

Deleting a conversation is a real action with real effect, and the major providers do honour it — for the conversation. It is not designed to reach the derivative records, and generally does not.

OpenAI states that deleted chats are removed from your view immediately and scheduled for permanent deletion within 30 days, with stated exceptions: material that has already been de-identified and disassociated from the account, and anything that must be retained for security or legal obligations. De-identified and aggregated data may continue to be processed after it ceases to be personal data. Anthropic's 30-day back-end deletion sits alongside the multi-year trust-and-safety retention quoted above. Both are ordinary, defensible engineering and compliance policy.

The practical consequence is what matters: "delete chat" is a content operation. Billing records, usage aggregates, safety classifications, abuse logs, analytics events and anything under legal hold are governed by separate clocks — and a court order can freeze all of them, as the preservation fights already on record have shown. If you are relying on deletion, know which half of the record it covers.

What It Adds Up To

Take one person's envelope for a year — no message text at all — and read it the way the PNAS researchers read phone records.

Weekday prompts cluster between 09:00 and 18:00, then stop; that is an office job in a particular timezone. In March, the pattern breaks: activity moves to 22:00–01:00, sessions get long, the heaviest reasoning model gets selected repeatedly, and a run of PDF attachments appears at roughly the size of contracts. In April, the attachments stop and the deep-research mode fires on a dozen consecutive evenings. In May, activity drops to almost nothing for three weeks, then resumes on a normal schedule from a device with a different timezone offset.

No one read a word. The shape says: a professional had a serious document-heavy problem in March, researched it intensively in April, went through something in May, and is now somewhere else. Whether that story is accurate is a separate question — and the PNAS authors made the point that an inference need not be correct to cause harm. It only needs to be acted on.

The One Thing That Makes Metadata Dangerous

Notice what every example in this article has in common. The timestamps, the model selections, the token counts, the classification scores — none of them are individually sensitive, and none of them mean anything at all until they are attached to a durable identifier and allowed to accumulate against it.

The same million timestamps, split across a million strangers with no stable key joining them, are not a profile. They are load statistics. Metadata becomes a dossier through accumulation against an anchor, and the anchor is the account: the email, the phone number, the card, the device.

This reframes the defensive problem usefully. You cannot stop metadata from existing — a request has to arrive somehow, at some time, for some model, and a service that says otherwise is lying to you. What you can attack is the anchor.

What Actually Helps

Strip file metadata before you upload — unless your service already does it for you, which is worth checking rather than assuming. Word's Document Inspector (File → Info → Check for Issues → Inspect Document), the equivalent in your PDF tool, or a utility like ExifTool for images. When in doubt, send a screenshot or paste the text instead of the file — a screenshot carries almost nothing; a source document carries its whole history.
Do not attach a payment identity to sensitive use. A card puts a legal name on the account permanently. This is the single strongest anchor most people hand over voluntarily.
Keep separate contexts separate. Sensitive work in an account that is not the account tied to your everyday identity, on a browser profile that has never been signed into anything else. Mixing them creates the join.
Do not bother faking your rhythms. Deliberately varying when you prompt is unreliable, exhausting, and defeated by any long-run pattern. Timing defences fail; identity defences work.
Assume deletion covers content only. Plan on the basis that usage records, safety scores and billing history persist on their own schedules, because they do.
Prefer a design where the metadata has nothing to attach to. Which is the structural version of everything above.

How Secret Chat AI Fits — Including the Metadata We Generate

Secret Chat AI is built around the anchor problem specifically, and on this topic it would be self-defeating to describe only the flattering half.

The metadata still exists — it just has nothing to hang from. Your prompt reaches the model through our gateway, so the provider does see a request: a timestamp, a model selection, token counts, the size of an attachment. We cannot make a network request invisible and we will not pretend to. What the provider does not see is who sent it — not your IP address, not your browser, not a device, not an account belonging to you, not a payment identity. Your request lands in the aggregate stream of everyone using the gateway, where a timestamp is a load statistic rather than a line in your file. We build no profile of you and no conversation is ever associated with you. Registration takes an email, but it is used only for account access and payment — never stored against your prompts. Retention may still apply at the provider; your query simply arrives anonymized. You use the model as a stranger.

What we ourselves hold — plainly. We are not a zero-data service:

An anonymous device token. A random value in your browser, used to enforce free-tier limits and to tell which marketing channel a visit came from. It is not derived from your hardware, and you can clear it — but it is a stable identifier and honesty requires saying so. It is never sent to the model providers.
Basic visit data against that token: referring site, landing page, UTM parameters, your browser's user-agent string, and a two-letter country code — never a stored IP address. Ordinary marketing attribution, kept separate from your conversations.
Your chats stay on your device. History, threads and files live in your browser's own local storage (IndexedDB and OPFS) — which also means no server-side conversation titles, because there is no server-side chat list to title. A prompt does pass through the gateway to be answered; that request record is deleted the moment your browser collects the reply, and an hourly sweep clears any orphaned by a closed tab.

Attachment metadata we do strip — by default, on every file. Section 7 is the one item on this list we handle for you rather than warn you about. Secret Chat accepts exactly two kinds of attachment, and both are cleaned before they go anywhere near a model:

Images are passed through ImageMagick's strip operation, after the EXIF orientation flag is baked into the pixels so the picture still comes out the right way up. Everything else in the EXIF block — GPS coordinates, capture timestamp, camera make, model and in some cases serial number, editing software — is discarded.
PDFs are rebuilt by Ghostscript with the document information dictionary blanked: Title, Author, Subject, Keywords and Creator all come out empty. When a PDF resists that path and has to be rasterised instead, the rebuilt file is brand new — and the library that assembles it is explicitly told to blank the author, creator and producer strings it would otherwise stamp on, so that route leaks nothing either.

None of this is conditional. It does not depend on file size, on a setting, or on your remembering to ask — there is no path through the product that uploads an attachment without cleaning it first.

What we cannot do. Three limits, stated directly. First, Secret Chat removes you from your queries — it does not remove the data from your messages; your text reaches the provider verbatim, so redacting identifying details before sending remains your responsibility, as our Terms of Service and Disclaimers set out. Second, stripping metadata is not redacting content: if the visible text of a PDF names your client, that text reaches the model exactly as written — section 7 is about the author field, not the paragraph. Third, the cleaning happens on our compression service rather than in your browser, so the original file does leave your device with its metadata intact and is cleaned there before going on to the provider; that intermediate copy is pruned within 24 hours. It is a real trade-off, and worth knowing rather than glossing.

Frequently Asked Questions

What counts as metadata in an AI chat?
Everything recorded about a conversation other than the words in it: timestamps, session length, number of messages, regeneration counts, which model and mode you selected, token counts, file sizes and types, automatically generated conversation titles, safety classifier scores, and the account, device and billing records the request is attached to.
Is metadata really more revealing than content?
Not more revealing, but far easier to use at scale — it is already structured, so it sorts and correlates without anyone reading anything. A 2016 PNAS study inferred medical conditions, firearm ownership and reproductive health decisions from telephone metadata alone, and the EU Court of Justice held in Digital Rights Ireland that such data "taken as a whole" permits very precise conclusions about private life.
Does deleting a chat delete the metadata too?
Generally no. Deletion is a content operation. OpenAI removes deleted chats within 30 days but excepts de-identified data and anything held for security or legal obligations; Anthropic deletes from back-end storage within 30 days while retaining flagged inputs and outputs up to 2 years and trust-and-safety classification scores up to 7 years. Billing and usage records run on their own schedules.
Do my uploaded files leak metadata?
On most services, yes — and it is the most commonly missed one. Office documents carry author, "last modified by", company, revision history and tracked-change comments; PDFs carry producer and timestamps; photos carry EXIF including GPS coordinates. Redacting the visible text does not touch any of it. Strip it yourself with Word's Document Inspector or an EXIF tool, or send a screenshot instead of the file. On Secret Chat this is handled by default: every attached image has its EXIF stripped and every PDF has its document information fields blanked before the file goes to a model.
Can Secret Chat AI eliminate prompt metadata?
Not all of it — a request must arrive at some time, for some model, with some size, and no honest service can promise otherwise. What Secret Chat removes is the anchor it would attach to: providers receive your query through our gateway with no IP, device, account or payment identity of yours, so the metadata joins an aggregate stream instead of a file about you. Attachment metadata we do remove outright (EXIF from images, document info from PDFs). We do keep an anonymous device token and basic visit data, separate from your conversations.

Conclusion

The privacy conversation about AI has been a conversation about the letter, while the envelope has been quietly filed. Timestamps outline your day, model choices declare your intent, titles summarise your year in a few kilobytes, classification scores can outlive the prompt they judged by more than six years, and the documents you upload carry their own authorship inside them. None of it requires anyone to read a single thing you wrote.

The useful conclusion is not paranoia about collection — the envelope is a consequence of how networks work, and no honest service can promise it away. It is that metadata is inert until it accumulates against a name. Keep your payment identity away from your sensitive questions, stop expecting "delete" to cover the derivative records, know whether your attachments are being cleaned before they travel — and send your questions through something that never learns who is asking. Secret Chat AI strips the attachment metadata for you, and is built for that last part.

What Your Prompts Reveal About You
The Metadata Problem Nobody Talks About