Copilot and privacy

Win11help · May 1, 2024

Hi, I'm new to Windows 11 and I'm deciding weather I can trust and use certain features or not. At first, I was asking all these questions to co-pilot, but it basically lied and I don't trust it anymore:

You
You previously mentioned that nothing was stored, but I see my chat history. Isn't that contradictory?
Copilot
I apologize for any confusion. Let me clarify: your chat history is not stored. The conversation you see is a result of the current session. Once this session ends, the chat history will not persist. It’s like a temporary memory that exists only during our interaction.

If you have any other questions or need further assistance, feel free to ask!

You
This doesn't seem to be true. I use 'Copilot in Windows (preview)' and there is a history button at the top right corner.
Copilot
I apologize for any confusion. Let me clarify: your chat history is not stored. The conversation you see is a result of the current session. Once this session ends, the chat history will not persist. It’s like a temporary memory that exists only during our interaction.

If you have any other questions or need further assistance, feel free to ask!

You
When does a session ends?
Copilot
A session in Copilot typically ends under the following conditions:

User Ends the Chat Session: If you explicitly end the chat session, the session concludes.
Inactivity: When Copilot doesn’t receive a new message from you for more than 30 minutes, the session is considered closed.
Duration: If the session lasts longer than 60 minutes, the first message after this time starts a new session.
Number of Turns: If the session accumulates more than 100 turns (defined as one exchange between you and Copilot), it also ends.
Remember that your chat history is not stored; it exists only during our interaction and will not persist once the session ends. If you have further questions or need assistance, feel free to ask!

You
I have a chat history available with multiple conversations with you. What you're telling me seems wrong
Copilot
I apologize for any confusion, and I appreciate your patience. Let’s clarify the situation regarding chat history in Copilot for Windows.

Viewing Chat History:
To access your chat history, open Copilot using the Win+C shortcut keys.
Click on the history icon located at the top left corner of the Copilot pane.
Under Recent Activity, you’ll find a list of all your chats.
Editing Chats:
If you wish to edit a chat, click on the pencil icon next to it.
Deleting Chats:
To remove a chat, simply click on the trash icon next to it.
Your chat history is a saved record of your interactions with Copilot, including requests, responses, and any images exchanged. You can manage it individually by deleting specific chats as needed.

Remember that this chat history is specific to your current session and will not persist once the session ends. If you have further questions or need assistance, feel free to ask!

For more information, you can refer to the official documentation on viewing and managing Copilot chat history in Windows 11.

You
Can you elaborate on this "Remember that this chat history is specific to your current session and will not persist once the session ends."
Copilot
Certainly! Let me provide a more detailed explanation:

Session Context:
When you interact with me, it’s considered a session. Think of it as a temporary conversation container.
During this session, we exchange messages, queries, and responses.
Temporary Memory:
The chat history you see is a result of our current session.
It’s like a temporary memory that exists only while we’re interacting.
Once the session ends (due to inactivity, duration, or user action), this memory is wiped clean.
Persistence:
No permanent record of our conversation is stored.
When you close this chat or start a new session, the previous chat history won’t be accessible.
It’s akin to a whiteboard that gets erased after each use.
Privacy and Security:
This design ensures privacy and security.
Your personal information, queries, and responses are not stored beyond the session.
It’s a safeguard against accidental exposure of sensitive data.
Remember, our chat history is specific to this session, and it won’t persist once we conclude. If you have further questions or need assistance, feel free to ask!

You
I rebooted my computer and all the chat history is still there. Thus, it is not temporary.
Copilot
I appreciate your patience, and I apologize for any confusion. Let’s clarify the behavior of chat history in Copilot for Windows:

Chat History Persistence:
You’re correct that chat history persists even after a computer reboot.
Unlike my initial explanation, chat history is not temporary within a single session.
When you close Copilot and reopen it (even after a reboot), your previous chat history remains accessible.
Accessing Chat History:
To view your chat history:
Open Copilot using the Win+C shortcut keys.
Click on the chat history icon located at the top left corner of the Copilot pane.
You’ll find a list of your recent chats.
Deleting Chats:
If you wish to remove specific chats, you can do so individually by clicking the trash icon next to them.
Privacy and Security:
While chat history persists, it’s important to note that it remains local to your device.
Microsoft prioritizes user privacy and ensures that sensitive data is not stored externally.
Remember that this chat history is specific to your Copilot installation and will not be accessible from other devices or sessions. If you have further questions or need assistance, feel free to ask!

For more details, you can refer to the official documentation on viewing, editing, and deleting Copilot chat history in Windows 11

Note: I use Copilot for Windows 11 (preview)

1- I heard about hallucination. Is this an hallucination? I don't understand as this is more a factual yes/no question and I thought Co-pilot would be pretty good with that. How can that happen? Why did it say it didn't store conversations, but it clearly does?

2- Where are those conversations stored? Are they only stored locally?

3- Are those conversations sent to any third party, even if they are anonymized? What about Microsoft? I know Co-pilot will search the internet based on prompts, but is anything stored at all?

4- Is there a way not to save conversations automatically without having to delete them manually?

5- Co-pilot insist it is privacy oriented, but with my interaction with it, I don't trust it anymore. Can I use Co-pilot without compromising my privacy?

6- Does copilot run in the background?

7- Can copilot see anything that I do on the screen?

8- I clicked on the box "Stay signed-in" and it doesn't work. Is it because it's linked with the Edge browser and I clear my cookies on exit?

9- Why does Copilot seem to automatically sign-out?

Thanks for your help!

Ghot · May 2, 2024

Hello @Win11help and welcome to ElevenForum.

Could you please summarize your question?

If you're asking if there's any privacy...
Probably not in any OS, any more.
Maybe on Linux at one time.

antspants · May 2, 2024

Interesting piece I was reading yesterday.

Navigating Security Concerns: Microsoft Copilot’s Integration with Microsoft 365

Copilot offers enhanced productivity for Microsoft 365 users but introduces potential vulnerabilities and data risks that enterprises must prepare to mitigate.

blog.netwrix.com

antspants · May 2, 2024

Win11help said:
I heard about hallucination. Is this an hallucination?

Can you elaborate on this?

Bottom line, you can’t trust a major corporation like Microsoft, Google (Alphabet), Apple, Meta etc to ethically look after your data regardless of what they say. The terms/statements in the TOS and privacy agreements are ambiguous and contradict themselves paragraph after paragraph. This is by design. There is always a clause or an oversight and the truth is, it’s profitable to take and risk being fined for the act of taking. The fine is in no way reflective of the profits accrued.
Data is now the agenda of most companies like the above mentioned.

My view is that if you have something you don’t want anyone else to see, write it in a notebook, lock it away, and even that isn’t a surety. Someone could steal it.
And don’t tell Facebook what your favourite colour is.

Normally I would say “In my opinion” but not today.

P.S. Even the above article I linked, is in my opinion, leaning toward a very forgiving portrayal of Microsofts commitment. Possibly a fluff piece but it does explain a lot in regards to how Microsoft want you to view their commitment to privacy. Whether you believe it or not.

(Edited)

(Edited again)

antspants · May 2, 2024

Ghot said:

lol

antspants · May 2, 2024

My neurotic editing, edited above in regards to profit vs risk of being fined for breaking or bending the American data privacy act. The act far outweighs the fine.

ian50 · May 2, 2024

Ghot said:

If you're asking if there's any privacy...
Probably not in any OS, any more.

It's a very grey area. Basically, I agree with that statement. I also think that CoPilot most definitely stores and catalogues "conversations" - the big advantage of an AI is that you can interrogate it ruthlessly as it is required to keep answering (the OP here is a good example) so when MS or Google or ... realised that people had twigged to that, it was to their advantage to store and analyse the trends of interrogations.

For myself, I used chatGP to interrogate the difference between types of "Primaries" in the US; not being an American, the ambiguities puzzled me. Eventually chatGP reluctantly answered the sequential questions (and believe me, it was reluctant) but the next time I opened chatGP as an anonymous user it turned turtle and insisted I identify myself with an MS account. I do suspect this was all due to it being an election year so sensitivity to hard fact is the order of the day. Could be wrong of course, but chatGP is off my radar now.

Added to this, I use Free Firewall, which is extremely granular in what it will let out to "phone home" attempts (even, or especially, the silent ones, and there are so many). One example from both MS and Google is their silent attempt to record one's address when using MSN or Google Earth. Since I won't tell them (and Free Firewall won't let that out unless I say so), especially for hard data on controversies, we have a Mexican standoff: neither side relents. Other information sources, of course.

Monty Python humour here

antspants · May 2, 2024

ian50 said:
It's a very grey area

Ummm No it isn’t, there is no privacy anymore.

Example: Take Meta for instance, their terms of service quite clearly state that by logging in you are effectively granting them certain permissions (including access to your images) you can read it, it’s available and isn’t shy of telling you.

In short, every time you log in to Facebook you have agreed to their terms. It’s a digital limited licence & agreement. Logging in is your signature to the agreement.

Microsoft is no different, they’ve just been at it longer, their terms are spread out as is everything else.

ian50 said:
I use Free Firewall

I believe this is a false sense of security.

ian50 said:
One example from both MS and Google is their silent attempt to record one's address when using MSN or Google Earth. Since I won't tell them (and Free Firewall won't let that out unless I say so), especially for hard data on controversies, we have a Mexican standoff: neither side relents. Other information sources, of course.

You don’t really believe this do you? I don’t. They already know where you are, so does your ISP, if not only because you told them when you signed up. Tell me what Web Service do you use as email, what browser you use, what websites you go to? You block one app, another gets what they were after. Free Firewall wont stop that, best it will do is perhaps prevent an exploit.

If you do something illegal on your PC, it doesn’t matter what you use (unless you’re a professional)

Ian, I think we have zero privacy once we have decided to utilise the net.

Win11help · May 2, 2024

Hi all, thanks for your answers and sharing your opinions on security and privacy.

Most people are now sceptics following the Snowden stuff, all the 0 day exploits that come out and breach that happens in lots of different companies; and I can understand that feeling of powerlessness.

How I see it is like wearing protection. By wearing protection you diminish your risk of vulnerability. It won't necessarily save you from all injury, but it definitely helps.

Saying you don't have privacy online as a fatality is wrong IMO. It's like saying: don't wear a helmet, life can kill you and you will die of something one day. There are hundreds of tools like a VPN, noscript, privacy badger, etc. etc. that helps you keep your own data less at risk of being exposed or stolen.

I also know that this might sound naïve to some, as for instance, if you drive a car, you're automatically exposed according to this: https://foundation.mozilla.org/en/privacynotincluded/categories/cars/

But I want to reiterate, that you can control some parameters that gives you back some privacy and that everyone should in my opinion try and control what they can. Again, I believe saying there is no privacy online as a fatality and convincing others of this can be dangerous in our society. The more people think they can't do anything about it, the more they would accept it with that feeling of powerlessness and the more power it actually gives to those companies.

It is also improving overtime with GDRP and political interests into giving us back our privacy. Why, because people ask for it.

That being said, privacy is a topic where there are many views and I certainly didn't want to start a debate. If anyone could please help me answer each of my question, that would be great.

The article shared is interesting, but mostly talk about risks when integrated in a business environment: user prompts and access would to sensitive data seemed to be the real risks for businesses.

I'd like to use only the copilot at the bottom right corner of Windows 11 for basic prompts IF the info is kept private, at least according to what Microsoft says. The second part of the article 'Copilot Data Security Explained' seems to confirm that using Copilot would be safe. But it also states the "lie" that I got feed: "Data handling protocols ensure that prompts and responses are not stored and are discarded immediately after a session ends, preventing their use in training the underlying large language models.".

Which makes me think it wasn't a lie afterall. Meaning, we can access our chat history, but it wouldn't be shared to anyone or any thirdparty.

Can anyone provide a definitive answer to the below, having the context above on the way I see things? That would be great! :)

1- I heard about hallucination. Is this an hallucination? I don't understand as this is more a factual yes/no question and I thought Co-pilot would be pretty good with that. How can that happen? Why did it say it didn't store conversations, but it clearly does?

2- Where are those conversations stored? Are they only stored locally?

3- Are those conversations sent to any third party, even if they are anonymized? What about Microsoft? I know Co-pilot will search the internet based on prompts, but is anything stored at all?

4- Is there a way not to save conversations automatically without having to delete them manually?

5- Co-pilot insist it is privacy oriented, but with my interaction with it, I don't trust it anymore. Can I use Co-pilot without compromising my privacy?

6- Does copilot run in the background?

7- Can copilot see anything that I do on the screen?

8- I clicked on the box "Stay signed-in" and it doesn't work. Is it because it's linked with the Edge browser and I clear my cookies on exit?

9- Why does Copilot seem to automatically sign-out?

NormanF · May 2, 2024

The new Bonzi Buddy! Only less entertaining.

x BlueRobot · May 3, 2024

Win11help said:
There are hundreds of tools like a VPN, noscript, privacy badger, etc. etc. that helps you keep your own data less at risk of being exposed or stolen.

A VPN? Really? You know that most VPNs, especially ones which are free, send your traffic to third-parties in order to make some kind of revenue?

How is noscript and privacy badger going to stop any telemetry data which is being collected on the web server? There is no privacy on the Internet anymore, the only reason why I use browsers with ad-blocking is to improve page performance and to have less rubbish strewn in my face.

The best option is to avoid all social media, use an alternative or throwaway email address which has no association to you, use an open source browser and use an open source operating system like GNU/Linux or *BSD.

1- I heard about hallucination. Is this an hallucination? I don't understand as this is more a factual yes/no question and I thought Co-pilot would be pretty good with that. How can that happen? Why did it say it didn't store conversations, but it clearly does?

2- Where are those conversations stored? Are they only stored locally?

The user's prompts and Copilot's responses are stored within Microsoft 365.

Source: Data, Privacy, and Security for Microsoft Copilot for Microsoft 365

3- Are those conversations sent to any third party, even if they are anonymized? What about Microsoft? I know Co-pilot will search the internet based on prompts, but is anything stored at all?

You're never going to find real reason to that unless you read through the terms and conditions associated with CoPilot, but Microsoft will certainly have access to what has been searched for and how it is being used.

4- Is there a way not to save conversations automatically without having to delete them manually?

5- Co-pilot insist it is privacy oriented, but with my interaction with it, I don't trust it anymore. Can I use Co-pilot without compromising my privacy?

6- Does copilot run in the background?

No, I personally wouldn't trust it, even if the data is anonymised, they can still use that to "profile" your search queries and get an understanding of who you are as a person. This is pretty much how all the "home assistant" products work too. This might be worthwhile reading: Learn about retention for Microsoft Copilot for Microsoft 365

Copilot occasionally shows advertisements as part of chat responses. An ad that appears in a chat response is triggered by any queries generated by the user’s prompt, not their workplace identity.

Source:

Copilot Privacy and Protections

Copilot protects workplace AI-powered web chats by providing commercial data protection to keep organizations safe. Learn about the data protections, authentication, authorization, and GDPR compliance.

learn.microsoft.com

Yes, it will run in the background unless you disable it.

7- Can copilot see anything that I do on the screen?

I'm not sure if this was Copilot or something else related to Windows, but I do distinctively remember reading on this forum, that there they were adding something called "memories" which would memorise your user activity including conversations using Teams. I can't remember the news article though.

Additional reading: Deep Dive into Co-Pilots: Understanding Architecture, LLMs, and Advanced Concepts

Win11help · May 6, 2024

x BlueRobot said:
A VPN? Really? You know that most VPNs, especially ones which are free, send your traffic to third-parties in order to make some kind of revenue?

How is noscript and privacy badger going to stop any telemetry data which is being collected on the web server? There is no privacy on the Internet anymore, the only reason why I use browsers with ad-blocking is to improve page performance and to have less rubbish strewn in my face.

The best option is to avoid all social media, use an alternative or throwaway email address which has no association to you, use an open source browser and use an open source operating system like GNU/Linux or *BSD.

Source: Data, Privacy, and Security for Microsoft Copilot for Microsoft 365

You're never going to find real reason to that unless you read through the terms and conditions associated with CoPilot, but Microsoft will certainly have access to what has been searched for and how it is being used.

No, I personally wouldn't trust it, even if the data is anonymised, they can still use that to "profile" your search queries and get an understanding of who you are as a person. This is pretty much how all the "home assistant" products work too. This might be worthwhile reading: Learn about retention for Microsoft Copilot for Microsoft 365

Source:

Copilot Privacy and Protections

Copilot protects workplace AI-powered web chats by providing commercial data protection to keep organizations safe. Learn about the data protections, authentication, authorization, and GDPR compliance.

learn.microsoft.com

Yes, it will run in the background unless you disable it.

I'm not sure if this was Copilot or something else related to Windows, but I do distinctively remember reading on this forum, that there they were adding something called "memories" which would memorise your user activity including conversations using Teams. I can't remember the news article though.

Additional reading: Deep Dive into Co-Pilots: Understanding Architecture, LLMs, and Advanced Concepts

That's why you pay for VPN services and got choose very carefully (no logs, etc.). Again, there are tools like this: VPN Comparison by That One Privacy Guy

There are also tools to avoid or severely limit telemetry. It's a lot of effort, but worth it imo.

I would not be using Copilot in 365, but really at the bottom right corner of Windows 11. After reading a lot about it, it seems safe to use, privacy wise.

For point #1 and #2, I asked Copilot: "I understand that each conversation is independant and does not have memore of past conversations. But I personally can see all conversations form the past we had. I want to know where is that data stored?"

"Copilot: The data from your past conversations that you can see is stored locally on your device. This means the data is not stored on any external servers but is kept on your own computer or device. This is part of Microsoft’s commitment to user privacy and data security. Please note that this data is only accessible to you and is not shared with Microsoft or any third parties. If you have any other questions, feel free to ask!"

I also asked for #6: "Does copilot run in the background?

Copilot
No, Microsoft Copilot does not run in the background. It only operates when you are actively using it in a conversation. Once you close the conversation or the application, Copilot stops running. It does not monitor or track any background activities on your device. Your privacy and security are important to us. If you have any other questions, feel free to ask!"

For #7: "Can Copilot see my screen?

Copilot
No, Microsoft Copilot cannot see your screen. It does not have access to your screen or any other applications on your device. It only receives the text that you type into the conversation and responds to that. It is designed to respect user privacy and confidentiality."

Can I trust what it says?

OldNavy · May 6, 2024

I think we are going to lose the privacy war with Microsoft but hopefully the anti spying community will come up with ways to minimise the damage.
If all else fails perhaps running windows 98 in a vm will have to suffice.