Codex just talks to the responses API with store=false. So unless the model detects you are doing something that qualifies as abuse, nothing is retained.
Codex is open source, you can inspect it yourself, but let's not let facts ruin your David vs Goliath fantasy.