Who can see your OpenClaw agent's conversations?
OpenClaw stores everything locally, but every message still passes through a chat platform and a model provider. Who can technically read what, and the dials that change it.
Four parties can potentially see an OpenClaw conversation: whoever controls the machine it runs on (transcripts and memory live there in plain SQLite and markdown), the model provider every message is sent to for thinking, the chat platform carrying your messages (Telegram can technically read bot chats; WhatsApp’s encryption ends at the agent’s device by design), and, if someone hosts it for you, your operator. OpenClaw’s own docs put it exactly right: “OpenClaw’s own state is local, but external services still see what you send them.” Each party has different dials; here’s the whole map, verified against the providers’ own policies as of August 2026.
Party one: the machine
Everything the agent is lives on its host: session transcripts in per-agent SQLite under ~/.openclaw, memory and identity as plain markdown files. That legibility is a feature (you can read everything your agent knows) and a responsibility: anyone with root on the box can too, and backups inherit the same sensitivity. OpenClaw itself phones home remarkably little: no conversation telemetry (an install-event ping exists only for authenticated ClawHub installs, and it’s disableable), and the update check is read-only. There’s even an incognito mode that keeps a session in process memory instead of on disk. As the docs note, though, your model provider still processes what you send.
Party two: the model provider
Every turn, including the memory files injected as context, goes to whatever model you configured. The current policies, from the providers’ own pages (all dated 2026-08-10; these drift, check before relying):
- OpenAI API: not used for training by default (“Your data is your data”); abuse-monitoring logs retained up to 30 days; zero-data-retention exists but is approval-gated.
- Anthropic API: “Anthropic may not train models on Customer Content”; deletion within 30 days, with one asterisk: content flagged by safety systems can be kept up to 2 years.
- OpenRouter (the multi-model router): doesn’t store prompts by default (does store token-count metadata), never trains on your data itself. But it’s a router: the downstream provider’s policy applies. The dials that matter: a settings toggle stops routing to providers that train, and zero-data-retention can be enforced per-account or per-request. The OpenRouter data-policy guide covers the exact controls.
The pattern: API traffic is treated far more conservatively than consumer chat apps, and “no training” is the API-side norm. But transient processing and abuse-window retention are facts of every hosted model. The only way out of party two entirely is a local model, which is a hardware question.
Party three: the chat platform
The channel you talk through sits in the middle, and the platforms differ more than people assume. Telegram: bot conversations are cloud chats. They’re encrypted client-to-server, stored on Telegram’s servers, and explicitly not end-to-end (only Secret Chats are; the Bot FAQ is upfront that bots receive private-chat messages). WhatsApp is end-to-end encrypted. But E2E means encrypted between endpoints, and the agent’s linked device is a full endpoint: messages decrypt on the agent’s machine, which is the whole point. Meta can’t read them in transit; the machine can, because it’s the recipient. Matrix is the standout: OpenClaw supports real E2E rooms, making it the one channel where even the server in the middle reads nothing.
Party four: whoever operates the machine
If you self-host, parties one and four are both you: the cleanest arrangement, priced in admin work. If someone runs the machine for you, they hold root, and no host can claim otherwise, which is why this deserves to be answered in writing, not assumed. Everpod’s own answer: one customer per machine; no reading of a pod’s content except with your permission during support, or where security, abuse investigation or the law requires it; and deletion of the machine and its backups when you leave, all written into the privacy policy and the security overview. Whoever you choose, the test is the same: can they tell you, specifically, who can see your agent’s data and when? A vague answer to that question is itself an answer.