Irrevocable, Perpetual, and Displayable in Public: What You Grant xAI When You Type Into Grok
Part of a series examining xAI’s terms and data practices. This is the foundational piece: what the consumer contract actually says about the things you type.
People talk to chatbots differently than they talk to search engines. The interface invites it. You explain context, describe situations, paste in documents, and think out loud. Voice mode makes it more conversational still. The whole design encourages a kind of disclosure that a search box never did.
So it is worth knowing precisely what happens, contractually, to the things you say.
xAI’s consumer Terms of Service answer that question in a single sentence. It is long, and it repays reading slowly:
“In choosing to submit, create, generate, record, post, or display Inputs on or through the Service, you grant an irrevocable, perpetual, transferable, sublicensable, royalty-free, and worldwide right to xAI to use, copy, store, modify, process, adapt, transmit, distribute, reproduce, publish, upload, download, display in public forums, list information regarding, make derivative works of, and distribute such Content, including anything referenced therein, in any and all media or distribution methods now known or later developed, for any purpose…”
Four things in that sentence deserve individual attention.
- Irrevocable. You cannot withdraw it. Not by changing your mind, and not by closing your account.
- Perpetual. It never expires.
- “Display in public forums.” The license expressly includes publicly displaying your content.
- “For any purpose.” The specific purposes listed afterwards are introduced by “including but not limited to” so they serve as examples, not limits.
And note what the license attaches to. Not Output, which is what the model generates. It attaches to Input. What you type.
“You Own Your User Content”
The clause sits directly beneath a heading that reads “You Own Your User Content,” and the accompanying text confirms it: “you retain your ownership rights to the User Content.”
That is true. It is also close to irrelevant.
Ownership matters because it is normally exclusive. You decide who may use the thing, and on what terms. A license this broad removes the exclusivity while leaving the title. You still own it. xAI may use, publish, modify, sublicense, and publicly display it, anywhere, forever, for any purpose.
What is left of ownership after that is mostly the word itself.
This is the pattern to watch for in any platform document: a reassuring heading above a broad grant. The heading is what users remember. The grant is what governs.
The People Who Aren’t You
The clause immediately following extends the license to third parties who never agreed to anything:
“To the extent the User Content includes a person’s image, likeness, voice, or other similar attributes, you grant xAI the same rights to use those attributes as part of the User Content as described above. You represent and warrant that you have obtained all rights, licenses, notices, permissions, and consents necessary for xAI to use that User Content.”
Think about what routine use of an AI assistant involves. Uploading a photo that has other people in it. Sharing a voice memo from a colleague. Pasting an email thread. Asking for help with a document someone else wrote. Sending a family video to be described.
In every one of those cases, you have contractually represented and warranted that you obtained that person’s permission for xAI to hold a perpetual, irrevocable, publicly displayable license in their image or voice.
Essentially nobody has done this. Essentially nobody knows they have promised it.
A “representation and warranty” is not a polite request. It is a contractual guarantee that allocates risk. If someone whose likeness or voice ended up in your upload ever objects, the clause points at you. The platform took the right; you guaranteed it was lawful to take.
The Opt-Out That Vanishes When You Log Out
xAI does provide a training opt-out, and credit where it is due, not every AI product offers one. But read the provision in full:
“When logged into our Service, you can select whether or not you want us to use your User Content to improve our products and services and train our models… Where available, you may access our Service without logging in; when doing so, where permitted, you grant us full rights to use any data you provide to or obtain from our Service for product development and model training purposes.”
The control is conditioned on being signed in. Use the service anonymously and you grant full rights, with no opt-out available at all.
This inverts an assumption most privacy conscious people hold: that not creating an account is the cautious choice. Under these terms, anonymous use is the least protected state. The user who deliberately avoids signing in gets the weakest position.
It is a genuinely counterintuitive design, and worth stating plainly: if you are using Grok on consumer terms, signing in and opting out is strictly better than staying logged out.
The Instruction That Can’t Be Followed
There is a line near the top of xAI’s Privacy Policy that deserves more attention than it gets:
“We ask that you do NOT include personal information in your prompts and inputs into our Service; however, we cannot control what you provide to us.”
And, on sensitive categories: “We do not aim to collect sensitive personal information… and ask that you do not provide us with any such information.”
Get Ian Rothfuss’s stories in your inbox
Join Medium for free to get updates from this writer.
Consider what is being asked. This is a conversational assistant, marketed for voice chat, personal assistance, and, in its Grok Bot form, autonomous work inside your own logged in tools. The interaction model is disclosure. Asking users not to mention personal information to a product designed to be talked to is like asking people not to get wet in a swimming pool.
The request may be sincere. But it functions as a transfer of responsibility. If personal data ends up in the system, the user was told not to put it there. It changes the rhetorical position without changing anyone’s behavior, because the behavior is what the product is for.
Deletion, and What It Doesn’t Reach
The Privacy Policy offers real deletion mechanisms, and they are worth using. Private Chat conversations “will be deleted from xAI systems within 30 days.” Deleted conversations and deleted accounts follow the same window, each “unless it is necessary to retain the data for legal, compliance, or safety purposes.”
But hold that against the license. Personal information may be deleted under the Privacy Policy. The content license in the Terms is irrevocable and perpetual.
These two documents are not obviously reconciled, and where they conflict, the Terms govern. This does not necessarily mean xAI retains licensed copies of your data indefinitely after you click delete. The practical implication, however, is that you should treat deletion as reaching your account and your personal data, while treating the legal license over what you typed as a right you cannot officially claw back.
The rest of the retention regime is open ended by design: “We retain your personal information where we have an ongoing legitimate business need to do so.” No default period is stated.
What’s Genuinely Good Here
A fair account has to include what xAI does well, because some of it is better than its competitors.
The Google OAuth carve out is a real, specific limit: “xAI shall not use any Google Apps content for any of its internal AI or other training purposes… including developing new products or services based on such content.” That is a narrow, enforceable sounding promise, and it is unusual.
Private Chat with a stated 30 day deletion window is a concrete control, not a vague assurance.
A training opt-out exists at all for logged in users. xAI maintains a published subprocessor list, a privacy portal with an appeals path, a named Data Protection Officer, an EU Digital Services Act point of contact, and appointed representatives in the UK, EU and Switzerland. It commits not to process training data to infer sensitive categories, and not to use uploaded images for identification.
It is also unusually candid in the Terms about the product’s limits, noting that outputs may “hallucinate,” may be offensive, or may misrepresent real people. None of this is window dressing. It is a more developed privacy apparatus than several larger companies maintain.
The Objection That Remains
The critique is not that xAI collects data, or that it trains on it, or that it has not built controls. It is narrower.
The license is broader than the product requires.
Training a model on user conversations requires a license to use that content for training. It does not require a perpetual, irrevocable right to publicly display your inputs, sublicensable to third parties, for any purpose, in media not yet invented.
That is not a data science requirement. It is a drafting choice. It is the maximal grant, taken because it can be taken, in a document nobody negotiates and almost nobody reads.
And we know the company can write something narrower, because it did. Its Enterprise Terms promise that user content will not be used to train models or develop new products at all. The restraint exists. It is allocated by contract tier.
What to Do
- Sign in. The opt-out only works for authenticated users. Anonymous use grants the most rights to the platform.
- Turn on the training opt-out and use Private Chat for anything you would mind seeing again.
- Treat the license as permanent. Whatever you type, assume you cannot retrieve the right to it. That is not paranoia; it is what “irrevocable, perpetual” means in a contract.
- Be careful uploading other people. Photos, voices, correspondence, and documents written by colleagues all trigger a warranty you almost certainly cannot honor.
- If it is work product, check your tier. If your organization has an enterprise agreement, use it. The protections are materially different, and they are the ones you would want.
Based on xAI’s Terms of Service (effective June 26, 2026) and Privacy Policy (effective April 4, 2026), reviewed August 2026. These documents revise on independent schedules, so verify current versions before relying on any quotation. Note also that use of Grok on the X platform is governed by X’s terms, not xAI’s, and that xAI’s API and enterprise offerings are governed by separate agreements. Analysis, not legal advice.
Sources:
- xAI Terms of Service: Consumer (eff. June 26, 2026): https://x.ai/legal/terms-of-service
- xAI Privacy Policy (eff. April 4, 2026): https://x.ai/legal/privacy-policy
- xAI Terms of Service: Enterprise: https://x.ai/legal/terms-of-service-enterprise
- xAI Consumer FAQs: https://x.ai/legal/faq
- xAI Europe Privacy Policy Addendum: https://x.ai/legal/europe-privacy-policy-addendum
