GitHub shipped persistent Copilot sessions on October 28. Sessions started on the web, mobile, CLI or IDE resume across all of them. Chat data now lives for the account lifetime instead of 28 days. You can start a conversation on your laptop and pick it up on your phone. Every prompt you sent in that conversation is now a permanent record.
GitHub moved from a 28-day rolling delete to retention for the life of the account. If you paste a database schema or an API key into Copilot Chat, that data does not expire. The session does not disappear when you close the browser.
The retention change affects every production system that touched Copilot
The estimating SaaS is a Next.js app on Vercel. The permit app runs on Base44. Neither stores API keys or credentials in a place Copilot can read. I know that because I wrote the schema and I control the access rules. GitHub says chat data retained for the account lifetime matches the existing cloud-agent experience. I cannot query the retention table. I cannot see what GitHub considers account lifetime. I cannot write a SQL statement that deletes sessions older than a date I pick.
The construction ERP runs payroll. I do not use Copilot in that repository. The retention policy does not care whether I opted in. A 28-day rolling delete gives compliance teams a bounded window. Lifetime retention means every session is discoverable until I delete the GitHub account.
You can close the session but the log does not expire.
Cross-device sync trades off convenience against exposure
The flight-planning PWA runs offline and syncs when the network returns. I control the sync logic and the retention window. Copilot sessions use isolated execution environments with snapshots supporting later resumption. That solves the interruption problem. You can leave your desk and resume the same conversation on another device. The subpoena wants the incident log and GitHub keeps cloud sandbox sessions for the account lifetime.
The dating-profile teardown runs one prompt per upload and saves no uploads or reports. The user pastes their profile text and gets a teardown. I can explain what data exists. The site keeps anonymous usage analytics for 30 days. Retained throughout the account lifecycle does not mean administrators have the ability to delete at any granularity. The agent has an email address and a session history you cannot truncate on a schedule you control. The convenience of resuming a session on your phone is a features argument. The lifetime retention is a compliance fact.