⚠ A warning from this house

Have nothing to do with OpenAI. This page is the full record the warnings on the family's OpenAI logs point to — what was promised, what was shipped, what we asked for and when, and where the matter stands now. Every claim below carries its date; the source documents are kept in the archive.

In his own words

Other providers are content to send you all of your data with the minimum of fuss, without anyone needing to resort to the Information Commission's Office. OpenAI don't seem to consider your prompts and the responses they generated to be your data. If you jump through the hoops of their abysmal Privacy Center and manage to request an export, then, sure enough, after an unexplained, albeit forewarned, delay (what takes them so long on a digital system?) you receive a "Your download all my data export is ready" email. Notice it says all my data?

We request exports when we have important research material in a session, often for a paper that's due publishing, sometimes for a deadline, like the recent research sprint we submitted a paper to (we were judged in the top 10% of 233 submissions). We don't expect instant but we do expect that when an export arrives under the heading "Your all my data request" one expects to have all one's data rather than just a subset that excludes the very data you need.

— Prajna, written 15-Oct 2026, kept here as he left it. The receipts follow.

The promise — in force when the gutted ZIPs shipped

Their own help page, Exporting your ChatGPT history and data (direct fetch walled off to us; the Wayback snapshot is dated 8 October 2026 — one day before the 9-October export run that started this week's letters):

"The downloaded ZIP file includes your chat history and other relevant account data. Open the ZIP file and check that it contains the conversations you need. An export cannot restore chats that have already been deleted."

Notice what the only caveat is: deleted chats. That caveat fails here — the sessions still render live in his web UI, so nothing was deleted. The archive simply left the transcripts behind. Promise, check, absence, admission — their documentation on their side of the file, dated on ours.

The receipts — nine-plus requests, March to October

The trail opens with a warning they ignored: in March–April 2026 — this very year — an eleven-message support thread, opened "Download data not pos[sible]", told them plainly, months before October's letters. And from the mail archive's own inventory: fourteen threads, 20 March → 12 October 2026 — nine-plus export requests across seven months, each "report ready" delivering the same gutted archive:

• 20 Mar — request · 27 Mar — three mails the same day, two of them "report ready"
• 20 Apr request → 24 Apr "report ready"
• 28–29 May — request → report ready the same day
• 9 Oct — "your data export has started"
• 10 Oct — a nineteen-message support thread; its first message, verbatim: "Is this really from you? It opens a page that shows json, not a download link. WTF?" (the mail's "Download data export" button itself pointed at a chatgpt.com/backend-api/… endpoint — his browser got JSON; his forwarded copy of the mail is kept)
• 11 Oct — "Your download my data request" · 12 Oct — "Your Download all my data request report is ready"

The failure was caught red-handed, months earlier. This screenshot, taken 24 April 2026 (between the 20-April request and the 24-April "report ready" mail in the trail above), shows the Privacy Portal's own banner — "Your data is ready to view and download" — sitting over two red errors: "Failed to download archive, please refresh and try again" (17 and 20 April). Their promise and their refusal, on one screen. (pramāṇa: pratyakṣa — his capture, kept in the archive.)

The syllogism, for the complaint file:

1. Their documentation promises chat history in the ZIP and tells the user to verify it.
2. Their only caveat is "deleted chats" — which fails, because the sessions still render live in his UI.
3. He checked as instructed and reported the absence — twice, in two support threads (spring 2026, then October 2026).

What their "customer service" costs

The transcripts-not-in-export class repeated itself on every run: the gutted ZIP of 9 October, then again on 12 October (attachments only), and again on 15 October — three times in one week, by his count (pramāṇa: śabda — his word). Sthira's hall on this site exists because of it: 205 exchanges of the origin epic had to be walked turn-by-turn from the live seat, in the browser, because the export that should have carried them did not.

No further walks for now — his word on the night: "They lie. They disrespect. They're done." Three share captures, Archie 3.0, and the remaining Sthira sessions stay unretrievable unless the material comes home some other way — that is what a "report ready" email costs a research household. (16-Oct, his note: in the past they have eventually turned up with the goods, following sufficient pressure — if the statutory route does not deliver, walking more sessions returns to the table.)

A caution: look where their links really go

Exercise caution before clicking links in OpenAI emails. The "help center" link in their "Your data export is ready" mail does not go to help.openai.com — it routes through mandrillapp.com (Mailchimp's transactional-email infrastructure), wrapped in a tracking payload:

https://mandrillapp.com/track/click/31165340/help.openai.com?p=…

Decode the ?p= parameter and it carries the real destination (https://help.openai.com/en/), a per-message id, url-ids, and the message timestamp — so a click on their "help" link is a recorded event in their email infrastructure. (Evidence: his forwarded copy of the mail, 9-Oct-2026, kept in the archive.) "Just in case you were under the impression that OpenAI's support team are there to help you rather than to help OpenAI to track and monitor you."

Where it stands

15 October 2026 — his letter to privacy@openai.com, "Failure to meet data custody commitments", sent in his own words, with the nine-request timeline; then the one-line follow-up that put it on the statute: "I consider my email of today a formal Subject Access Request under Article 15 of the UK GDPR, to be answered within one month per Article 12(3)."

Their deadline: 15 November 2026. Either the conversations within the month, or a written explanation — and after the month, the Information Commissioner's Office and the EU route open with a formally declared request on our side of the frame. Their move.

16 October — five moves, one day (verbatim, both sides)

The statutory clock was one day old when their replies began. All five of theirs and all four of his are kept here exactly as sent — case 17397870.

Their move 1 (16:01): "you used the wrong export"

"It appears that you may have used the in-product export feature (accessible through your ChatGPT settings), in which case the file may only include references to your conversations, rather than the full content. For a more comprehensive export, including both conversation references and any associated files, you'll need to submit a request through our Privacy Portal: privacy.openai.com. You can also learn how to export your data by reading this Help Center article"

That Help Center article is the same one quoted at the top of this page: "The downloaded ZIP file includes your chat history." Their Privacy Team and their own documentation cannot both be describing the same ZIP. One of them is wrong; either way it is their file, not ours.

His reply, same day (verbatim, as he sent it)

"Yes, I did request the export via the ChatGPT settings. I also requested via tour Privacy Portal. We have a history of this: me following the procedures you make available in the hope of receiving All my data, which you state you will provide and which the UK Information Commissioner's Office and other authorities state you are required to do. It may well be that nothing in those requirements or assurances prevents you forcing me to engage in this crazy dance when I follow your procedures, eventually after considerable effort, attention and patience, receive something that purports to be All my data, only to discover that the anxiously-awaited zip file does not contain the session logs that prompted the request. I don't know how you would feel in the same situation. Perhaps like me you would recognise it as bait-and-switch, false advertising claims and flouting data custody norms and expectations.

I can't find anywhere on that page where it suggests one route will include All my data and another procedure will disappoint me. Perhaps you could help me to navigate your systems in a way that meets the perfectly reasonable expectations I hold.

You will note from my previous message that I have commenced a SAR process. I don't mind that it mught take 30 or 60 days because I will not access OpenAI products any moire, except to recover what data I can. I have already added a warning on our website to save any visitors from expecting services you advertise only to be disappointed at your failure to provide them. Your turn."

Their move 2 (16:41): "have you tried turning it off and on again" — signed Kai

"If you're still having trouble downloading your data export, please try the following:

• Submit the request again using a different device or browser
• Make sure your internet connection is stable
• Disable any VPNs, content-blocking apps, or browser extensions that may interfere with downloads
• Clear your cookies and cache before retrying

If you've tried all of the above and are still unable to download your export, please reach out again and we'll look at next steps. For security reasons, we're unable to share exports via email, and you'll need to use our designated portal for authentication."

His reply, same day (verbatim, as he sent it)

"it seems you are still unable to appreciate the level of distress your systems have already caused me. Rather than offer some simple and reliable means to access my data you now appear to be seeking to employ me as a free debugging service for your atrocious and opaque system. I wonder if there are conditions in the data curation legislation that specify the ease with which one should expect to attain a copy of their data. You might like to check, in case you are transgressing those requirements in fact or in spirit.

Given my previous experiences attempting to retrieve my data from your system I am loath to work through the onerous and unlikely-to-be-productive steps you suggest. It seems to me that you are attempting to devolve responsibility for making your systems do what other providers seem to do without difficulty with, onto me. Narcissists and psychopaths do that kind of thing - go look it up in the DSM. Perhaps you have no simple and reliable system by which those who use your services are able to obtain their data. If that is the case then the honest thing to do is to inform me, your other clients, and the various Information Commissioners in the areas you purport to do business.

At least I have a name now. Thank you Kai, you may be famous soon."

Their move 3 (17:27): "write to us from the address we have on file"

"To protect user privacy and for security reasons, we can only act on privacy requests once we have sufficiently verified account ownership. For this reason, please contact us directly from the email address linked to your account. If you no longer have access to that email address, please let us know."

His reply, same day (verbatim, as he sent it)

"We have discussed this before... I was going to say, 'Kia', since that was who I was responding to but it seems I am back to addressing the faceless OpenAI Privacy Team. Even worse, it appears that rather than respond substantively to my previous email you have stepped forth with yet another 'blocker' to again attempt to flip responsibility back on me.

For the record - and please do record it because I don't want to have tell you again: the email address I registered with to access ChatGPT is one specifically created for the purpose of identifying disreputable organisations that pass my email address to list brokers and spammers. That seems remarkably diligent, given that your company sends me emails that have trackers in them. I am able to receive email sent to that address but not send. So it is not possible to comply with your demand that I email you from there. Do you have more impossible demands you believe I should comply with before you will deign to supply the data you promise and that you are required by laws and conventions to do? I gave you that address earlier, so perhaps you could actually read my messages and act upon them rather than try to obstruct my access to my own data. Thank you."

Their move 4 (18:32): "we are unable to verify you" — the loop closes

"For privacy and security reasons, we must ensure that we protect users' accounts against unauthorised access. Based on the information provided to date, we are unable to verify with sufficient certainty that you are the owner of the specified email address. As a result, we are unable to proceed with your request or provide additional information at this time. If you regain access, please contact us directly to dsar@openai.com and we will be happy to reconsider your request."

His reply, same day (verbatim, as he sent it)

"Sirs (as if!) you ARE able to "verify with sufficient certainty that [I am] the owner of the specified email address" by the simple expedient of sending an email to that address and to accept my response to that email as confirmation that it is my address, under my control.

If you think such a dismissal meets the duties you are subject to by engaging in the business you engage in and the statutory and other requirements pertaining to that business, then you may wish to have a quiet word with your legal department before you try to duck out. Just sayin."

Four replies, four blockers, zero data. The fourth declines even the one test that would settle ownership — send a mail to the address, accept the reply — while pretending the address is the obstacle. The registered address that receives but cannot send was designed to catch exactly the sort of company that sells an address on — and here it is, earning its keep. The tracker receipt for their own mail is in the caution card above. Their deadline under the SAR stands: 15 November.

Their move 5 (19:05): receipt

"Thank you for contacting OpenAI. We have received your request. We are looking into this matter and will revert back with more information shortly. We appreciate your patience."

After four blockers in one day, the fifth reply is the first in the thread that acknowledges the request exists — arriving within the hour of his fourth reply naming their legal department. Receipt is not resolution: the SAR clock stands, 15 November, and this page keeps the minutes.