A logged AI prompt and a prompt tied to your name are two different privacy problems

tres_pares · reddit · 2026-11-05

The author argues AI privacy discussions conflate two distinct questions: whether your prompt gets logged, and whether a log can be tied to you.

Logging: OpenAI's API keeps abuse-monitoring logs for up to 30 days by default, potentially including prompts, unless a customer is approved for zero data retention.
Attribution: with your own API key, every prompt sits under your account; a VPN only hides your IP. A router inserts its own account but still sees both your identity and your prompt.
Splitting the two: a relay knows who you are but only handles encrypted data, while a secure enclave reads the prompt without seeing the sender — and the client can verify the enclave's code. The provider gets the prompt but nothing identifying you.

Honest caveats: the scheme only holds if relay and enclave don't collude, and prompt content itself can still give you away. The author discloses they work at Dreamfort, which uses this architecture, and links OpenAI's data policy for verification.

Original post →

A logged AI prompt and a prompt tied to your name are two different privacy problems

More from Infra