Grok (SpaceXAI)

Does Grok train on your data? Unless you opt out, xAI can use your public X posts and your Grok conversations to train its models. The opt-out is in X’s privacy settings, and the Grok app has its own data control.

Plain-English risk rating: 5 of 5 (Consumer Grok) / 3 of 5 (Grok API)

Consumer Grok is the highest-risk consumer AI product in this database — a 5 of 5.

The reason is structural, not behavioural. Most other consumer AI tools in this database, ChatGPT, Claude, Gemini and Perplexity among them, train by default on the conversations you have with them (Microsoft no longer states its consumer app's position). Grok does that plus trains on every public post you have ever made on X, including posts that pre-date your awareness Grok exists, including posts from before xAI existed. The training data ingestion surface is the entire X platform, not just your interactions with the AI. There is no consumer AI product in this database with comparable data scope.

Grok API sits at 3 of 5. Enterprise tiers exist but are less commonly contracted than competitors, and the parent platform's default-aggressive training behaviour means SMB owners using Grok API should verify their contractual exclusions explicitly rather than assume them.

Recommended for

  • Sole proprietor: Honestly, no. Use ChatGPT, Claude, or Gemini consumer with training opt-out. Grok's value proposition is real-time X integration, which most SMB owner-operators don't need
  • Small team (2-10 people): Grok Business (US$30 a user a month on SpaceXAI's pricing page) lists “No training” and custom data retention, but single sign-on is Enterprise-only, and it does nothing about what your staff's personal X accounts feed into Grok, which is the bigger exposure for most teams. Corrected 24 October 2026: we previously said there was no Grok offering for small teams on the privacy axis.
  • Regulated industry: Strongly no. The breadth of default data ingestion is incompatible with regulated-data handling. We are not aware of a Grok deployment pattern that produces HIPAA, PCI, or comparable compliance
  • The honest answer for most 1-10 employee businesses: Skip Grok for business use entirely. If your team uses X personally, ensure they understand that their personal X posts have been training Grok by default since 2024 — opt them out and treat their X presence as a permanent public-data exposure they cannot fully retract

What makes Grok structurally different

The other AI vendors in this database have a "conversation in, training out" data flow: you talk to ChatGPT, ChatGPT may train on the conversation. Grok has that flow plus a parallel "everything you've ever posted publicly on X, training in" flow.

The SpaceXAI privacy policy and X's data-sharing terms (effective November 15, 2024 and subsequently updated) confirm Grok is trained on:

  • Your public X posts (including historical posts predating Grok)
  • Your engagements (likes, reposts)
  • Your conversations on X Spaces
  • Your profile information (bio, display name)
  • Your interactions with Grok itself
  • Grok's outputs and your feedback
  • Your conversation history with Grok

The opt-out controls:

  • Training opt-out: X's help centre now gives the path (Privacy & Safety, Data sharing and personalization, Grok & Third-party Collaborators) without limiting it to the desktop website (read 23 October 2026). When this profile was written the setting was only on the desktop website. The standalone Grok app has its own "Improve the model" control under Data Controls.
  • Some users report the opt-out toggle is grayed out unless they set an account date of birth (regulatory artefact, related to the UK Age Appropriate Design Code)
  • Opt-out applies to future use only; data already used in training cannot be retracted
  • Making your X account private (Settings → Privacy and safety → Audience → Protect your posts → ON) excludes you from Grok training and remix tools per X's 2026 policy. This is functionally the strongest available protection but it also means your account stops being public

For SMB use, this matters because: any employee who has used their personal X account to discuss work topics (industry observations, frustrations with vendors, professional opinions) has been feeding Grok training data through that account, separate from any direct Grok usage.

Data retention default

  • Grok conversations: Retained per SpaceXAI privacy policy; conversation history available to the user
  • Private Chat mode: Sessions deleted within approximately 30 days
  • X posts ingested for training: Effectively permanent — once incorporated into a training run, data cannot be removed retroactively
  • Grok API: Per SpaceXAI commercial terms; verify per-contract

Training opt-out

TRAINING IS ON BY DEFAULT across all consumer surfaces.

Which document governs depends on where you use Grok. The SpaceXAI Privacy Policy expressly does not apply when Grok is accessed through a third-party service, and names X directly: Grok on X is governed by the X Privacy Policy and X Terms instead. The public-post training behaviour described here is an X-platform term, not an SpaceXAI one, and the two documents are revised on different cycles. We monitor both.

On grok.com and the Grok app (updated 3 October 2026): SpaceXAI's consumer Terms (11 September 2026) say that when you are logged in, “you can select whether or not you want us to use your User Content to improve our products and services and train our models” — in the app, Settings, Data Controls. If you use Grok without logging in, the Terms give SpaceXAI “full rights” to use what you enter for training, with no opt-out. Deleted chats are queued for deletion, which can take up to 30 days. The steps below are for Grok on X, which X's own terms govern.

To opt out on X (X's help centre gives this path without naming a platform; read 23 October 2026):

  1. Open X
  2. Settings and privacy → Privacy and safety
  3. Click "Grok & Third-party Collaborators"
  4. Uncheck "Allow your posts as well as your interactions, inputs and results with Grok and xAI to be used for training and fine-tuning"

Important: this opt-out controls future training only. Posts and conversations already ingested into existing model training runs cannot be removed.

For EU users: GDPR Article 21 provides a right to object to processing for AI training. Send a written objection to privacy@x.ai stating you object to your personal data being processed for the purpose of training Grok under Article 21. SpaceXAI must acknowledge and either comply or provide compelling legitimate grounds. The published SpaceXAI privacy policy does NOT state an EU training exclusion – it defers to a separate Europe Privacy Policy Addendum. The protection EU and EEA users actually have derives from regulatory enforcement: X gave the Irish Data Protection Commission an undertaking to stop processing EU user data for Grok training, formalised in a September 2024 Irish High Court order, with a further statutory inquiry opened in April 2025. Protection contingent on an ongoing enforcement posture is weaker than a policy commitment, and the Article 21 objection remains the individual backstop.

For sensitive conversations specifically: Use Grok's Private Chat mode (sessions delete within ~30 days, not used for training).

Zero Data Retention availability

  • Available on the API, by election, and stricter than most. SpaceXAI's Enterprise Terms (14 August 2026) offer a “ZDR-Enabled API”: content is deleted within one hour of the request or on delivery, and “no logs, backups, persistent copies, or other durable storage containing User Content will thereafter be retained for any purpose, including safety, debugging, or legal compliance.” (Corrected 3 October 2026: this line said ZDR was not offered in the same form as other API providers.)
  • Business, Enterprise and API without ZDR: the Enterprise Terms say content is “automatically and permanently deleted no later than 30 days after the end of the interaction or session”, unless another period is agreed or law or safety requires it, and that SpaceXAI will not use it to train models, “subject to disclosures to Customer and Customer-controlled user settings”.

Plan tiers and pricing (as of early 2026)

TierPrice (USD)Training on your data?Suitable for
Grok (free, on X)Included with X FreeYes, unless opted out — and trains on all public X postsNot recommended for business use
X Premium$8-16/monthYes, unless opted outPersonal X use; not appropriate for client work
X Premium+$40/monthYes, unless opted outSame caveats
SuperGrokFrom US$30 a month (Lite and Heavy tiers also listed)Yes, unless opted outPersonal heavy use
Grok BusinessUS$30 a user a monthNo (SpaceXAI lists “No training”)Teams; single sign-on is Enterprise-only
Grok APIPay-per-tokenPer contract; verifyDevelopers building applications, with caveats

Pricing for higher Grok tiers has changed multiple times during 2025-2026. Verify current pricing at grok.com / x.ai before subscribing.

Jurisdiction

  • Primary processor: SpaceXAI LLC, US-based (Texas-headquartered). The privacy policy (last updated 11 October 2026) names SpaceXAI LLC as the operator, though its section on US privacy requests still says x.AI LLC.
  • Corporate change, and it moves who controls your data. SpaceX acquired xAI on 2 February 2026, and from May 2026 xAI ceased to operate as a separate company, with Grok becoming part of SpaceX's AI division. Earlier versions of this profile named xAI Corp., which was correct when written.
  • The policy states that SpaceXAI is a separate company from X Corp. That distinction matters here: Grok used through X is governed by the X Privacy Policy and X Terms rather than this one, and the two are revised on different cycles. We monitor both.
  • Cloud infrastructure: operates its own data centres (the "Colossus" supercomputer cluster in Memphis, Tennessee, expanded through 2024-2026)
  • Data processed in the United States; EU residency not offered for consumer Grok
  • EU users protected by GDPR Article 21 right to object (see opt-out section); EU and EEA exclusion rests on regulatory enforcement (Irish DPC undertaking and September 2024 High Court order), not on a stated policy default

Breach history (public incidents)

July and November 2024: training on by default

Not a breach in the security sense, but a material policy change worth treating in the breach-history section because the scope of unauthorised-from-user-perspective data ingestion is comparable. X's November 15, 2024 Terms of Service update added a clause that gave X permission to use user data for AI training, including training xAI's Grok. The setting itself had been found switched on by default for existing users in July 2024, without opt-in notice. Multiple privacy advocates and security professionals publicly criticised the change — including Vanta CISO Jadee Hanson, who called training on customer data without notification "a major concern" — but the default has remained on.

Sources: SiliconRepublic; TechCrunch; Variety; Yahoo Tech (multiple, July-November 2024)

August 2025: shared Grok chats indexed by search engines Forbes reported on 20 August 2025 that more than 370,000 Grok conversations had become searchable on Google because the share button created public web pages, without warning users. Some included uploaded files, medical questions and at least one password. Source: Forbes, via 9to5Mac, 20 August 2025. Added 24 October 2026; this profile did not previously record it.

Ongoing — Grayed-out opt-out toggle for users without account date of birth

Multiple users have reported that the Grok training opt-out toggle in X settings is grayed out and unclickable unless the user has set a date of birth on their X account. The cause appears to be the UK's Age Appropriate Design Code, which requires privacy-protective settings to be the default for users under 18 — X's implementation apparently denies opt-out adjustment to any user whose age cannot be confirmed. The practical effect for SMB owners: if your X account does not have a date of birth set, you may not be able to opt out of Grok training without first providing that information.

Source: Roboin.io reporting (January 2026)

Note on Grok "Private Chat" branding: Grok's Private Chat mode does provide functional protection (sessions deleted ~30 days, not used for training) but the naming creates the same false-sense-of-privacy issue we saw with Perplexity's "Incognito" mode allegations. The protection is real for the specific chat, but does not extend to the user's broader X account activity, which remains in the training pool. SMB owners should not assume that using Private Chat once provides any protection for their other X activity.

Note on direct messages: Per SpaceXAI's documented policy, private direct messages on X are NOT used for Grok training (only public posts and explicit Grok interactions). However, given the platform's track record of policy changes implemented as default-on, this should be re-verified periodically rather than treated as a permanent guarantee.

Note on infrastructure breaches: No public confirmed breach of SpaceXAI's core model serving or training infrastructure has been reported as of May 2026. The risk picture is dominated by the policy-level data ingestion scope, not infrastructure failures.

What this means in plain English for SMB owners

Three honest takeaways:

  1. Grok is not a credible business AI choice for the privacy-conscious SMB owner-operator. The default-on data ingestion is structurally broader than any competitor in this database, the opt-out sits in X's privacy settings and may require a date of birth on the account, and while Grok Business and Enterprise terms keep your business content out of training, nothing in them changes what employees' personal X accounts feed into Grok.
  1. If you or your employees use X personally, opt out of Grok training today, even if you don't use Grok. Your public X posts have been training material by default since at least July 2024. Opting out now stops future ingestion. Past posts already in training data cannot be retracted, but the marginal harm reduction from opting out today is real.
  1. For the specific use case Grok is good at — real-time analysis of X content, conversation context from current X discussions, news-adjacent queries — there is no privacy-compatible substitute. This is one of the cases where the honest recommendation is: if you need this capability, do not use Grok with sensitive prompts at all. Use Perplexity or ChatGPT with web search instead for news-adjacent research, accepting that they lack the deep X integration. The capability that makes Grok unique is the same capability that makes it incompatible with confidential business work.

What the opt-out actually does, in SpaceXAI’s own words

The privacy policy points to SpaceXAI’s consumer FAQ for training and data controls, so that is where the operative detail lives. Four things in it change how a small business should treat Grok:

  • If you are not logged in, in most of the world you cannot opt out at all. SpaceXAI states that where permissible it may collect and retain unauthenticated content on an anonymous basis, and that in some regions (excluding the EU and UK) you will not have the option to opt out of model training when using Grok without logging in. New Zealand is not the EU or the UK. Using Grok logged-out is therefore the worst case, not the safest one – which is the opposite of what most people assume.
  • The opt-out is prospective only. SpaceXAI’s wording is that your new conversations will not be used to train. Anything already submitted is not pulled back. Same pattern as ElevenLabs: switch it off before you paste, not after.
  • Feedback survives the opt-out. SpaceXAI states plainly that even if you opt out of model training, feedback you later choose to give may still be used for training. The thumbs-up and thumbs-down buttons are outside the opt-out.
  • Private chat is the stronger control. Content and interactions in private chat are excluded from training, history is not viewable to you, and the conversation is deleted from SpaceXAI systems within 30 days. It is the ghost icon, top right.

And if you use Grok inside X, the control is not here at all. SpaceXAI directs you to the X Help Center for instructions on opting out of Grok training – a different company’s documentation, reached by a different route. That is the practical consequence of the two-document split described above.

One point in the user’s favour, stated for balance: SpaceXAI confirms you own the inputs and the outputs, and may use Grok’s outputs commercially. The risk here is disclosure of what you put in, not ownership of what comes out.

Sources

  • SpaceXAI Privacy Policy, https://x.ai/legal/privacy-policy (last updated 11 October 2026, read 24 October 2026; previously verified 29 August 2026 against the 24 August version). The contracting entity is stated as SpaceXAI LLC. This supersedes our note of 11 August 2026, which recorded that the site had rebranded to SpaceXAI while the contracting entity was still X.AI LLC — accurate when written, and changed by the 24 August policy itself.
  • X Privacy Policy, https://x.com/en/privacy (effective 15 January 2026; verified 2026-08-11) – the governing document for Grok on X.
  • SpaceXAI Consumer FAQ, https://x.ai/legal/faq (verified 2026-08-13) – the operative source for training opt-out, private chat and unauthenticated use; the privacy policy defers to it.
  • SpaceXAI Europe Privacy Policy Addendum, https://x.ai/legal/europe-privacy-policy-addendum (referenced by the main policy for EEA, UK and Swiss users).
  • Anonyome Knowledge Center: Grok privacy analysis (April 2026)
  • Roboin.io: How to opt out of Grok training 2026 edition (January 2026)
  • mePrism: X Grok AI training opt-out guide (2026)
  • Tom's Yahoo/TechCrunch: Grok training default reporting (2024-2025)
  • SiliconRepublic: Grok AI training on user data by default (July 2024)
  • Variety: Elon Musk's X activates Grok training default (2024)
  • TrustScan: How to opt out of Grok xAI data training 2026 guide (April 2026)
  • AgainstData: Opt Out of X Twitter AI guide (December 2025)
  • SpaceXAI pricing and Grok Business pages: https://x.ai/pricing and https://x.ai/grok/business (read 24 October 2026)
  • 9to5Mac: 370K Grok AI chats made public without user consent (20 August 2025, citing Forbes)

Related on AI Leakage

Compare similar tools: Grok (SpaceXAI) is one of 6 tools in AI chat assistants compared, which sets out each one’s rating and what it does with your data, side by side.