Yes they are stored on OpenAI's servers. The API calls are not used for model training per the TOS. However, not that I'm accusing OpenAI of anything, but there's no way to independently validate this.
But their guarantee is clear for the API (the ChatGPT web app is different, but you can disable training if you give up the history feature).
> At OpenAI, protecting user data is fundamental to our mission. We do not train our models on inputs and outputs through our API.
> ...
> We do not train on any user data or metadata submitted through any of our APIs, unless you as a user explicitly opt in.
> ...
> Models deployed to the API are statically versioned: they are not retrained or updated in real-time with API requests.
> Your API inputs and outputs do not become part of the training data unless you explicitly opt in.
It’s in principle possible to detect if a model has been trained on private data, e.g. if it can recite random data such as UUIDs that are not public. So if OpenAI were to break that promise, someone would notice and make it public. This is enough of a disincentive that I trust OpenAI will not do it.
But their guarantee is clear for the API (the ChatGPT web app is different, but you can disable training if you give up the history feature).
> At OpenAI, protecting user data is fundamental to our mission. We do not train our models on inputs and outputs through our API.
> ...
> We do not train on any user data or metadata submitted through any of our APIs, unless you as a user explicitly opt in.
> ...
> Models deployed to the API are statically versioned: they are not retrained or updated in real-time with API requests.
> Your API inputs and outputs do not become part of the training data unless you explicitly opt in.
- https://openai.com/api-data-privacy