what we do (and don't do) with your ChatGPT export

the actual flow, step by step

1. 1. You pick a file. Either a .zip straight from your OpenAI export email, or a raw conversations.json. The file stays on your machine.
2. 2. Your browser parses it. The zip is unzipped and the JSON is parsed by JavaScript running in your browser. No part of your file is uploaded yet. You can prove this: open DevTools → Network tab, then upload. The only network request that fires is to /api/roast, and you can inspect the request body — it's a small text digest, not your file.
3. 3. We build a digest. Up to 200 sampled user messages get clipped to 500 characters each, plus a list of conversation titles. ~10-20 KB of anonymized excerpts. None of the assistant's replies are included.
4. 4. We forward the digest to OpenAI.Our server is a thin pass-through: it receives the digest, calls OpenAI's API with the digest + roast prompt, returns the result to your browser. The digest is in memory for a few seconds, then discarded with the request.
5. 5. The result is shown to you. The roast card and digest are stored in your browser's sessionStorage so the "deep roast" option can work without re-uploading. sessionStorage clears the moment you close the tab.

what we do NOT do

• ❌ We do not have a database. There is no place for us to store your data, even if we wanted to.
• ❌ We do not write your file, your digest, or your roast to disk.
• ❌ We do not log the body of your upload. Vercel logs request metadata (size, latency, status code) but not body content.
• ❌ We do not share your digest with anyone other than OpenAI's API.
• ❌ We do not run analytics on the content of your chats. PostHog only captures aggregate events (e.g. upload_started, roast_received) and the archetype + score we returned. It never sees your messages.

about OpenAI

We use OpenAI's API (the developer API, not ChatGPT). Per OpenAI's API data usage policy, API submissions are not used to train OpenAI's models. OpenAI retains API data for up to 30 days for abuse monitoring, after which it is deleted. We do not have zero-retention enabled because that requires a separate agreement, so the data does pass through their 30-day window.

how to verify all of this yourself

1. Read the source. The entire app is open source: https://github.com/mudman266/roastmychats. The parts that matter:
   • • src/lib/parse-export.ts — parses and digests the file (runs in your browser)
   • • src/components/uploader.tsx — the upload UI; you can see only { digest } is POSTed
   • • src/app/api/roast/route.ts — server route; in-memory only
2. Inspect the network. Open DevTools → Network, click Preserve log, then upload your file. You'll see exactly two relevant requests: a POST /api/roast with a JSON body containing just { digest }, and the response with your roast. No file upload to our server.
3. Try with JavaScript off.Disable JS in your browser, then try to upload. The site won't parse anything — proof that the parsing is happening locally, not on our server.

contact

See something in the code that contradicts a claim on this page? Open an issue on the repo or email the address in the GitHub README. We'll fix it.