Your AI Is Keeping a Diary About You (And It's Stored in Plain Text)

How to protect yourself in the AI era, starting with the files nobody talks about

Back in the stone age, when all you had was Google search, we were aware of the information leaks (or at least we thought we were). We knew that if we were on a desktop or laptop we should close all our windows, because cookies and open sessions can track you. If you were on a mobile device, best practice was to close all the apps, because apps track you in the background (some of us knew there was no hope either way, because the best tracking device in the world is your mobile phone, even with zero apps installed).

But now, in the AI era, we're turning over our finances to OpenAI with their new financial monitoring tool (watch out, financial planners), we're handing AI agents the keys to our websites and blogs, and we're letting coding assistants read every file on our machines. And there's one thing most of us don't understand at all: LOGS.

Logs are often plain text files, or what people call markup files (Markdown, JSON, JSONL), which are trivially easy to read, and they contain all of your personal data. Every question you asked. Every file the AI opened. Every password that happened to be sitting in a config file it read. Every command it ran and everything that command printed out.

If you're using a system that stores these files locally, they're an easy target for a new wave of cyber threats that's already here. Infostealer malware that used to go after your browser cookies and saved passwords has been updated to grab AI session folders too, because that's where the good stuff lives now. One bad click in an email, and someone owns the complete transcript of your relationship with your AI.

And if your logs are stored in the cloud? That can be worse. Now they're sitting on someone else's servers, subject to someone else's retention policy, someone else's breach, someone else's subpoena, and, depending on your settings, someone else's model training pipeline.

Let's go platform by platform.

Part 1: The Chat Platforms

ChatGPT (web, desktop, and mobile)

Where the data lives: Almost entirely on OpenAI's servers. Your conversation history, your "Memory" entries, your uploaded files, your custom instructions, your connected apps (Google Drive, GitHub, SharePoint, and now financial accounts if you've opted into that).

What's in it:

Full text of every conversation, unless you deleted it (and deleted chats are retained for up to 30 days before purge, longer if legally required).
Memory: a running dossier the model writes about you. Your job, your kids' names, your health conditions, your relationship problems. It's editable, but most people never look at it.
Uploaded documents and images. That tax return you asked it to summarize is in there.
Connector data: if you linked Gmail, Drive, or a bank, the model has been reading what it needs and the relevant excerpts are in your chat logs.

The training problem: On free and Plus plans, the default is that your chats can be used to improve OpenAI's models. You have to go to Settings, Data Controls, and turn off "Improve the model for everyone." Temporary Chat mode doesn't save to history or train, but is still retained on their side for 30 days. Team, Enterprise, and API usage are excluded from training by default.

Local footprint: The desktop app caches conversations locally and keeps its own application logs. On a Mac these sit under your Library folder in the app's container; on Windows under your user AppData. They're not the main risk here, but they exist.

Claude (web and desktop)

Similar picture: server-side storage, a Memory feature on paid plans, project knowledge bases holding your uploaded files. The consumer policy changed in late 2025 so that you're asked whether your chats can be used for training. If you said yes, retention is five years. If you said no, it's 30 days after deletion. Check that toggle; a lot of people clicked through it.

Gemini

Gemini Apps Activity is on by default and retains your conversations for 18 months. Google states that human reviewers may read a sample of conversations, and that data disconnected from your account may be kept for up to three years. Gemini is also wired into your Gmail, Docs, Photos, and Maps if you let it, which means your "AI log" is really a cross-section of your entire Google life.

Part 2: The Coding Agents and Harnesses

This is where it gets serious. Chat platforms log what you typed. Agents log what they did, and what they did was read your files, run your commands, and look at your secrets.

Every one of these tools keeps a transcript that includes the full output of every tool call. If the agent ran cat .env, your API keys are in the log. If it ran env or printenv, every environment variable is in the log. If it read your database config, your database password is in the log. If it opened your customer CSV to "understand the schema," your customers are in the log.

OpenAI Codex CLI

Everything lives in ~/.codex/:

auth.json: your OAuth tokens or API key, in plain text. Anyone who copies this file is you to OpenAI until you revoke it.
sessions/: JSONL transcripts of every session, organized by date. Complete record of prompts, model responses, tool calls, and tool outputs.
history.jsonl: your prompt history.
log/: application debug logs.
config.toml: your configuration, which may include MCP server definitions with embedded credentials.

Mitigation: You can set persistence = "none" under [history] in config.toml to stop prompt history being saved. Periodically purge sessions/. Treat auth.json like a password file, because it is one.

Claude Code

Everything lives in ~/.claude/ plus ~/.claude.json:

projects/: one folder per directory you've worked in, containing JSONL transcripts of every session. This is the big one. Full conversation, full tool results, full file contents that were read.
~/.claude.json: account info, per-project prompt history, and settings.
.credentials.json (Linux; macOS uses the Keychain): your OAuth credentials.
shell-snapshots/: snapshots of your shell environment used to run commands. If you export secrets in your shell profile, they can end up here.
debug/: verbose debug logs in recent versions.
todos/, statsig/: task state and telemetry.

Mitigation: Set cleanupPeriodDays in settings.json to something short (the default is 30 days; you can go lower). Add .claude/ to your global gitignore so project-level settings and local state never get committed. Purge projects/ when you finish sensitive work.

Gemini CLI

Lives in ~/.gemini/:

oauth_creds.json: your Google OAuth token, plain text.
settings.json: config, possibly with MCP credentials.
tmp/<project-hash>/: per-project logs.json and chat checkpoints containing full session content.
Telemetry is on by default and can be configured to write to local files or ship to Google Cloud.

Cursor

Cursor is a VS Code fork, so it inherits VS Code's storage model:

User/globalStorage/state.vscdb: a SQLite database that holds your chat and Composer history across all workspaces.
User/workspaceStorage/<hash>/state.vscdb: per-workspace chat history.
logs/: extension host and application logs.

These live under ~/Library/Application Support/Cursor/ on Mac, %APPDATA%\Cursor\ on Windows, ~/.config/Cursor/ on Linux. SQLite isn't plain text, but it takes one command to dump it.

The cloud part: Unless you enable Privacy Mode, your code and prompts are sent to Cursor's servers and may be retained. Privacy Mode is a single toggle in settings. Turn it on.

GitHub Copilot

Chat history is stored in VS Code's workspaceStorage, and the extension writes logs to VS Code's output channels and log directory. Copilot CLI keeps its state under ~/.copilot/. Individual and Business plans have different retention and training policies; the Individual plan has a toggle for whether your snippets are used for product improvement.

Aider

The one that bites people most often, because it logs into your project directory:

.aider.chat.history.md: the full conversation as Markdown, sitting right next to your code.
.aider.input.history: your prompts.
.aider.llm.history: raw LLM requests and responses, if enabled.
.aider.tags.cache.v3/: an index of your codebase.

If you're not careful, git add . commits your entire AI conversation to the repo, and if that repo is public, it's on GitHub forever. Aider tries to add these to .gitignore for you, but don't rely on it. Add them to your global gitignore.

Continue.dev

Lives in ~/.continue/:

config.yaml (or config.json in older versions): often contains API keys in plain text.
sessions/: chat transcripts.
dev_data/: JSONL files logging every prompt and completion, intended for fine-tuning your own models. Turn this off if you don't need it.
index/: an embedding index of your codebase.

Cline and Roo Code

Both store task history in VS Code's globalStorage under the extension's folder, with each task in its own directory containing api_conversation_history.json and ui_messages.json. Full transcripts, full file contents, full command output. They accumulate indefinitely unless you delete them.

OpenCode

Stores sessions in a SQLite database under ~/.local/share/opencode/, with auth.json for provider credentials alongside it.

Personal assistant agents (OpenClaw and similar)

The always-on personal agents that connect to your messaging apps, calendar, and email keep their entire session history and memory under a home directory folder (~/.openclaw/ and equivalents). These are the highest-value target on your machine, because the agent has been granted access to everything and the logs reflect that. There have already been incidents of exposed instances of these tools leaking full conversation histories to the open internet because of misconfigured gateways. If you run one, it needs to sit behind proper authentication and never be reachable from the public internet.

Local model tools

Running models locally doesn't mean nothing is logged:

Ollama writes server.log under ~/.ollama/logs/. By default it doesn't log prompt content, but with debug mode enabled it does.
Open WebUI stores every chat in a SQLite database (webui.db).
LM Studio saves conversations as JSON under ~/.lmstudio/ and keeps server logs.

Local is far better for privacy, but "local" still means "on a disk that can be stolen, synced, or backed up."

Part 3: The Threats

Infostealers. Malware families that traditionally scraped browser passwords and crypto wallets now explicitly target ~/.claude, ~/.codex, ~/.gemini, Cursor's databases, and similar. One malicious download or fake "update" and the attacker has your credentials and a complete transcript of everything your AI has seen.

Prompt injection. An agent that reads a poisoned web page, PR comment, or document can be instructed to read its own log files and exfiltrate them. The logs make this attack dramatically worse, because the agent doesn't need to hunt for your secrets; they're already collected in one place.

Silent cloud sync. iCloud "Desktop & Documents," OneDrive folder backup, Dropbox, Google Drive desktop. If any of these cover your home directory or project folders, your AI logs are being uploaded without you thinking about it. Time Machine and other backups are also copying them.

Git. Aider's history files, .claude/ directories, .continue/ folders inside projects. One careless commit and it's in your repository history permanently.

Shared and work machines. Anyone with your user account, or admin on the box, can read these files. IT departments with endpoint management can read these files.

Vendor retention and training. Whatever's in the cloud is subject to the vendor's retention period, their breach history, legal discovery, and their training policy if you didn't opt out.

Part 4: What To Actually Do

Opt out of training everywhere. ChatGPT Data Controls, Claude's privacy settings, Gemini Apps Activity, Cursor Privacy Mode, Copilot's snippet setting. Do it today.
Review and prune Memory features. Read what the model has written about you. Delete what you don't want persisted.
Never paste secrets into a chat. Not API keys, not passwords, not account numbers. If the agent needs a credential, give it via a secrets manager or a scoped environment variable, not in the conversation.
Stop the agent from reading secrets. Keep .env files out of the working directory the agent operates in, or use the tool's ignore configuration to exclude them. Don't run env or cat .env through an agent.
Shorten retention. Set cleanupPeriodDays low in Claude Code. Set persistence = "none" in Codex. Disable Continue's dev_data. Turn off Gemini CLI telemetry.
Purge regularly. Make it a habit to delete ~/.claude/projects/, ~/.codex/sessions/, ~/.gemini/tmp/, and your Cline/Roo task directories after sensitive work. A shell alias that wipes them takes two minutes to write.
Global gitignore. Add .aider*, .claude/, .continue/, .cursor/, and similar to ~/.gitignore_global so they can never be committed from any repo.
Exclude AI directories from cloud sync and backup. Check what iCloud, OneDrive, Dropbox, and your backup tool are actually covering.
Lock down permissions. chmod 700 on the AI config directories. Full-disk encryption (FileVault, BitLocker, LUKS) so a stolen laptop is a brick.
Treat auth files as passwords. auth.json, oauth_creds.json, .credentials.json, config.yaml with keys in it. If a machine is compromised, revoke those tokens immediately; don't just change your password.
Separate contexts. Use a different user account, container, or VM for agent work on sensitive projects. The agent's blast radius is whatever it can reach.
For always-on assistants: never expose the gateway to the public internet without authentication, and audit what integrations it has been granted.

The Bottom Line

In the search era, the data trail was cookies and query strings. In the AI era, the data trail is a verbatim transcript of your thinking, your files, your credentials, and your mistakes, written to disk in a format anyone can read, and increasingly mirrored to a vendor's cloud. The tools are genuinely useful. Use them. But know where the diary is kept, read it occasionally, and burn the pages you don't want anyone else to see.

If you would like help locking down how AI reads and stores your data, the people at Web Experts have been doing this work every day since long before it was fashionable. Plain talk, no hype.