Copilot Memory Privacy: What to Save and What to Leave Out

Copilot memory privacy depends on which Copilot product and account you use: personal Microsoft Copilot, work or school Copilot, and GitHub Copilot have different storage and management rules. Review saved memory separately from conversation history, source documents, and the controls governing other uses of your data.

For project continuity, fenbs holds the approved work context you choose to share, outside an assistant’s personal memory. That is useful when a team needs the current decision without carrying every private chat detail into the next session.

Which Copilot account determines the privacy boundary?

Start with the signed-in identity and the service, not just the word Copilot. A personal Microsoft account, an employer-managed Microsoft account, and a GitHub account are different starting points. Record the exact product and organization before applying a retention statement or deletion instruction.

Microsoft’s organizational privacy documentation↗ (opens in a new tab) notes that Microsoft 365 Copilot is now called Microsoft Copilot, with older labels remaining in some experiences. Here, “work Copilot” means the organizational Microsoft 365 experience. GitHub Copilot remains a separate coding product.

Our Copilot vs. ChatGPT comparison covers broader assistant choices, while the GitHub Copilot app guide explains that coding environment. Neither product’s name is enough to establish which privacy promise applies to your account.

What should personal Copilot users check?

Microsoft’s privacy controls for individuals↗ (opens in a new tab) describe Saved memories under Settings, then Personalization in the updated Copilot app. Turning that switch off does not automatically delete existing saved memories. Review the saved entries through Manage and delete the ones you intend to remove.

The same guidance treats chat history, shared experiences, and advertising choices separately. Do not assume that a memory switch changes every use of your account data. Check the version-specific guidance if the menus on your device differ.

Keep personal memory modest. A preference for concise explanations may help regularly without revealing much. A one-time discussion about a colleague’s medical leave or a client’s bank details does not need to become reusable context. The better first question is whether that information should be entered into this account at all.

For the feature itself, see Microsoft Copilot memory. Privacy review begins when you decide which details are appropriate for continuing use, rather than after a surprising answer exposes an old assumption.

Where does work Copilot memory live, and how long can it stay?

Microsoft’s memory administration documentation↗ (opens in a new tab) says organizational memories are stored in a hidden folder in the user’s Exchange mailbox. Saved memories remain until explicitly deleted; deleting a chat does not delete a saved memory derived from it. The documentation also warns that Purview retention policies for chat interactions do not apply to Copilot memory.

That distinction matters when someone says “our chats expire.” Ask whether the statement covers conversations, saved memories, inferred details, or the underlying source documents. A storage location within your organization’s environment does not mean every employee can see it, and it does not mean the data is beyond authorized administrative access.

Ask your IT team which controls and review processes apply to your account. Use the current vendor documentation for retention details and deletion timelines; a single number copied into a team note will not describe every category. Keep memory cleanup on the checklist when a project ends or a person changes roles.

For teams, fenbs Decisions and rules provide a place to record the permitted use and the person who approved it. The rule should say what may be saved and who reviews it, rather than asserting that the assistant remembers safely by default.

How is GitHub Copilot memory different?

GitHub’s Copilot Memory documentation↗ (opens in a new tab) separates repository facts from user preferences. Repository facts can be available to others with access to memory in that repository; user preferences follow the individual’s interactions, with organizational management rules for managed subscriptions. A remembered coding preference is therefore not necessarily an exclusively private note.

GitHub describes automatic removal of unused entries, with the timer capable of resetting when an entry is validated and used. Follow the linked retention rules instead of treating that as a fixed lifetime for every remembered fact. Review the audience and ownership as well as the age of an entry.

GitHub’s personal memory controls↗ (opens in a new tab) explain how to review user preferences and, for repository owners, repository facts. When multiple organizations supply access, the billing entity helps determine who can manage a preference. Check the displayed ownership before assuming that an entry belongs only to you.

See GitHub Copilot memory for the capability and Copilot memory in VS Code for the editor-specific question. A file of instructions, a repository fact, and a chat transcript should not be counted as one memory store.

What information should stay out of reusable memory?

• Secrets and access material: passwords, tokens, private keys, and connection strings belong in the approved secret-management system.
• Unnecessary personal information: remove private details about employees, customers, students, or family members when the task does not require them.
• Unapproved conclusions: label a suggestion as a proposal rather than saving it as an operating rule.
• Temporary exceptions: describe the project and expiration condition so a one-time workaround does not shape unrelated work.
• Whole private conversations: retain the smallest approved outcome that another session needs, rather than the complete discussion.

Say a small software team learns that a client needs a different report layout. The reusable project fact is the approved layout and where the specification lives. A private explanation of the client’s staffing dispute adds exposure without helping the implementation.

Minimizing the record also helps correction. You can replace one outdated requirement more reliably than hunt through several conversations for every indirect mention. The shared record should make an assistant’s next step easier to check.

What does deleting memory fail to remove?

Deleting one memory entry does not establish that the source conversation or document is gone. Microsoft’s personalization guide↗ (opens in a new tab) distinguishes saved memories, chat-history inferences, and work insights. Its temporary-chat guidance also warns that organizational retention may still let administrators access the conversation.

Write a cleanup list by source: saved entry, relevant conversation, explicit instruction, and original document where applicable. Ask the administrator about records you cannot manage yourself. A useful cleanup note identifies the categories checked and remaining actions without repeating the sensitive content.

How to do this with fenbs?

1. Create a free account, free for one person with no credit card, and add the project you want to continue.
2. Record the approved rule for what belongs in shared context. Include its scope and the person who decided it in Decisions and rules.
3. Add tasks and a short context note containing only the necessary project facts. Link to approved source material instead of copying sensitive background.
4. For colleagues, use a team kanban board and suitable member roles. Connect a supported assistant using the relevant guide on the Integrations page; GitHub Copilot is listed there.
5. Ask the assistant to read project context before working and save progress when it stops. Review the saved information for both accuracy and audience.

fenbs does not manage Copilot memory, change Microsoft retention, or import private chats. It also does not connect to Microsoft Teams. If your only need is one person’s coding or response preference inside Copilot, its native memory controls may be sufficient.

What should your next privacy review produce?

Produce a short record of the product, account, allowed content, owner, and unresolved cleanup actions. Recheck it when the account or connected sources change. A successful review leaves a clearer boundary for the next session, rather than a broad promise that the assistant knows nothing.

For nearby questions, see whether Copilot has memory and ChatGPT memory privacy. The AI governance hub covers how teams assign responsibility for these choices.