Essential session state
ChatGPT on Sites supplies the upstream identity. AI Grounded separately places a random opaque app-session value in a first-party Secure, HttpOnly, SameSite=Lax __Host- cookie and stores only its SHA-256 digest server-side. A second short-lived __Host- cookie carries a one-time reauthentication challenge when a stale session must cross sign-out and sign-in. Blocking essential state prevents account features from working.
Device-local state
The public interface may use temporary browser session state for presentation and notification deduplication. Approved member preferences are stored with the member account when the user saves them.
No cross-site ad profile
AI Grounded states that its feed does not use unrelated-site browsing to build an advertising profile. Connected providers apply their own cookie and privacy terms when you leave AI Grounded.
Your controls
“Keep me signed in” is on by default so routine use does not repeatedly interrupt you. Every app session remains revocable, has a two-hour sliding inactivity limit, and ends after three days regardless of activity. Logging out revokes the server-side session before upstream sign-out. Clearing a cookie does not revoke its server record and cannot reset an expired lifetime; the app requires a verified sign-out/sign-in cycle before issuing another session. Sensitive control-plane actions can require a more recent step-up without shortening routine access. You can disconnect linked services or request account deletion through Data deletion. Read the Privacy policy for more detail.