Grok
Is Grok safe?
- Made by
- xAI
- Company based in
- United States
- Trains on your chats
- Yes, unless you opt out
- People can read chats
- Yes
- Temporary chat mode
- Yes
- Chats used for ads
- Not stated
- Minimum age
- 13
- Regulator actions listed
- 4
- Checked on
On the Grok apps and grok.com, SpaceXAI (formerly X.AI) may use your prompts, uploads and Grok’s replies to train its models unless you turn off “Improve the model”, and a limited number of authorised staff may read conversations. Feedback can still be used after you opt out. All personal data is processed in the United States; there is no EU entity, only a representative in Dublin.
Private Chat is not saved to history, not used for training and deleted within 30 days. Deleted chats and accounts are removed within 30 days. Business, enterprise and API data is not used for training. xAI says it does not sell data or share it for advertising, and states SOC 2 Type 2 compliance.
Grok inside X follows X’s own policies. In 2025 and 2026 Ireland’s DPC, the European Commission and the UK ICO opened inquiries or proceedings over Grok, mostly concerning X; the ICO investigation also names X.AI LLC.
- Company responsible for your data
- SpaceXAI LLC (formerly X.AI LLC) for the Grok apps and grok.com; Grok in X follows X's policies
- What is used for training
- SpaceXAI 'may use your content and interactions with Grok (e.g., prompts, searches, and other materials you submit) along with Grok's responses to train our models'; Private Chat content is not used. Feedback you give may be used for training even after opting out, and signed-out users outside the EU/UK cannot opt out.
- How to turn training off
- Mobile app: Settings > Data Controls > deselect 'Improve the model'. grok.com: Settings > Data > 'Improve the Model'. Opting out applies to new conversations. Grok on X: see X Help Center.
- Business and API plans
- 'We do not use content from our business and enterprise customers to improve our models'; API: 'xAI never trains on your API inputs or outputs without your explicit permission' (API data kept 30 days for abuse auditing).
- How long chats are kept
- 'You can keep your data on your SpaceXAI account for as long as you wish'; otherwise retained 'as long as reasonably necessary' for the purposes in the privacy policy.
- After you delete a chat or account
- Deleted conversations (or a deleted account) are removed within 30 days, unless kept for legal, compliance or safety reasons or already de-identified/pseudonymized and disassociated from your account.
- Human review
- Yes. 'A limited number of our authorized personnel may review your conversations with Grok' for purposes including improving model performance, investigating misuse and legal compliance.
- Temporary chat
- Private Chat (ghost icon): not shown in history, not used for training, deleted from SpaceXAI systems within 30 days (unless needed for legal, compliance or safety reasons). Not available in Build mode.
- Where data is stored
- Europe addendum: 'We process all of your personal information in the United States, where we maintain our primary data centers.'
- Age rules
- 13 (or the minimum age in your country); ages 13-17 need parent/guardian permission
- Ads
- FAQ: 'We do not sell your data or share it with third parties for marketing or advertising purposes.' The privacy policy also says cookies may be used to 'deliver relevant content and targeted advertising'; use of chat content for ads is not addressed directly.
- Security and certifications
- SOC 2 Type 2: xAI's developer security FAQ says 'We are SOC 2 Type 2 compliant' (details in an NDA-gated Trust Center); API data encrypted at rest. See https://docs.x.ai/developers/faq/security and https://x.ai/security.
- Regulator actions
Date Authority Action Source 2025-04-11 Irish Data Protection Commission Opened a GDPR inquiry into X Internet Unlimited Company over whether EU/EEA users' public X posts were lawfully processed to train the Grok models. https://www.dataprotection.ie/en/news-media/latest-news/data-protection-commission-announces-commencement-inquiry-x-internet-unlimited-company-xiuc 2026-01-26 European Commission Opened formal Digital Services Act proceedings against X over the risks of deploying Grok in X, including manipulated sexually explicit images and possible child sexual abuse material. https://ec.europa.eu/commission/presscorner/api/files/document/print/en/ip_26_203/IP_26_203_EN.pdf 2026-02-03 UK Information Commissioner's Office Opened formal investigations into X Internet Unlimited Company and X.AI LLC over Grok's processing of personal data and its potential to produce harmful sexualised images and video. https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/02/ico-announces-investigation-into-grok 2026-02-17 Irish Data Protection Commission Opened a large-scale GDPR inquiry into X Internet Unlimited Company over non-consensual intimate or sexualised images created with Grok on the X platform. https://www.dataprotection.ie/en/news-media/press-releases/data-protection-commission-opens-investigation-x-xiuc - Privacy policy
- x.ai
- Terms
- x.ai
- Data controls help page
- x.ai
- Sources
Page URL SpaceXAI Privacy Policy (effective Aug 24, 2026) https://x.ai/privacy-policy SpaceXAI Consumer FAQs https://x.ai/legal/faq SpaceXAI Terms of Service - Consumer (effective Sep 1, 2026) https://x.ai/terms-of-service SpaceXAI Europe Privacy Policy Addendum https://x.ai/legal/europe-privacy-policy-addendum xAI developer security FAQ https://docs.x.ai/developers/faq/security SpaceXAI Security page https://x.ai/security DPC inquiry announcement (11 Apr 2025) https://www.dataprotection.ie/en/news-media/latest-news/data-protection-commission-announces-commencement-inquiry-x-internet-unlimited-company-xiuc DPC inquiry announcement (17 Feb 2026) https://www.dataprotection.ie/en/news-media/press-releases/data-protection-commission-opens-investigation-x-xiuc ICO announces investigation into Grok (3 Feb 2026) https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/02/ico-announces-investigation-into-grok European Commission press release IP/26/203 (26 Jan 2026) https://ec.europa.eu/commission/presscorner/api/files/document/print/en/ip_26_203/IP_26_203_EN.pdf