Which AI coding tools train on your code? A 2026 privacy guide

AI coding assistants are the most useful new tool developers have adopted in years — and the fastest way to hand your employer's source code to a third party without noticing. The good news is that the privacy question has a surprisingly crisp answer, and it is almost never "which tool." It is which tier.

The short version: your subscription tier is your privacy policy

Across every major assistant, the same pattern holds: the free and personal consumer plans are the ones most likely to train on your input, while the business, enterprise and API tiers carry explicit no-training commitments. The tool is identical. The terms attached to your account are not. A developer using Claude Code on a personal Pro subscription to debug company code is on consumer terms; the same developer using Claude Code through their company's API is not.

So the single most important habit is boring but decisive: use the account your organization provides, on a commercial or enterprise plan, and never sign a work machine into a personal consumer subscription. Everything below is the detail behind that rule.

What actually happens to the code you send

When you accept a completion or ask an agent to refactor a file, that file (or a relevant slice of it, plus surrounding context) is transmitted to a cloud inference endpoint — GitHub/Microsoft, OpenAI, Anthropic, or Google — where a model generates the response. Two separate questions decide how private that is:

• Training. Is your input added to the data used to train future models? This is the one that permanently bakes a fragment of your code into a model other people use.
• Retention.How long is your input stored on the vendor's servers — for abuse monitoring, debugging, or legal reasons — even when it is not used for training?

"We do not train on your data" and "we do not retain your data" are different promises. The strongest tiers make both; consumer tiers often make neither by default.

Tool by tool (as of mid-2026)

Policies change — the dates and defaults below are current as of this writing and every claim links to the vendor's own documentation. Re-check the source before you rely on it, because these terms have moved more than once in the last year.

GitHub Copilot

On Copilot Business and Enterprise, GitHub does not retain prompts or suggestions and does not use your code to train models; it maintains no-training or zero-data-retention agreements with the providers it routes to. On the free/individual plan, a single setting — "Allow GitHub to use my code snippets" — governs whether your snippets feed product improvement; turn it off. You can also configure content exclusion to keep whole paths out of Copilot entirely. The catch worth internalizing: content exclusion does not apply in agent mode or the Copilot CLI— an agent can still read an "excluded" file by running cat or git show. See GitHub's Copilot Trust Center for the current commitments.

Cursor

Cursor's Privacy Mode is the whole ballgame. With it enabled — available on free and Pro, and on by default for Enterprise — your code is never used for training by Cursor or its model providers, under zero-data-retention agreements. With Privacy Mode off, Cursor's data-use policy says it may store and train on your codebase, prompts and editor actions. Two footnotes: codebase indexing uploads chunks to compute embeddings (the plaintext is discarded after the request, but embeddings and file metadata are stored), and a few newer models require provider-side retention and stay disabled until an admin approves them. Cursor is SOC 2 Type II.

Claude Code (Anthropic)

This is the one that changed most recently, and it trips people up. As of Anthropic's August 2025 consumer-terms update, the consumer plans (Free, Pro, Max) — including Claude Code used from those accounts — will train on your chats and coding sessions unless you opt out, and leaving the setting on extends data retention to five years (opting out keeps the previous 30-day window). The commercial plans (Team, Enterprise, the API, Bedrock, Vertex) are not trained on by default, per the Claude Code data-usage docs. One more detail: Claude Code caches session transcripts in plaintext under ~/.claude/projects/, so treat your own disk as part of the threat model too.

ChatGPT and the OpenAI API

In consumer ChatGPT (Free, Plus, Pro), pasted code can be used to train OpenAI's models unless you turn off "Improve the model for everyone" or use a Temporary Chat. ChatGPT Team, Enterprise, Edu and the API do not train on your inputs by default (the API has not since March 2023). A retention nuance worth knowing: during the New York Times lawsuit, OpenAI was under a court order to retain even deleted and temporary consumer/API content; that specific obligation ended in September 2025, and standard 30-day deletion resumed. "Delete" is only ever as durable as the current legal weather.

Google Gemini

Consumer Gemini appskeep your activity and may use it — including human review — to improve Google's products unless you turn off Gemini Apps Activity. On the paid Gemini API through Google Cloud / Vertex AI, Google commits not to use your prompts or responses to train its models; the free AI Studio tier is treated more like a consumer product, so read its terms before pasting anything sensitive.

Devin, Amazon Q, JetBrains AI and the rest

Agentic tools like Devin and enterprise assistants like Amazon Q Developer and JetBrains AI each publish their own terms, but the tier logic is the same everywhere: check whether your specific plan carries a no-training commitment and a defined retention window, and default to the business or enterprise tier for anything proprietary. If a tool cannot tell you plainly whether it trains on your input, treat that as a "yes."

The comparison table

The same information, at a glance. "Trained on by default" means what happens if you install the tool, sign in, and change no settings.

The agent-mode gap nobody puts on the pricing page

Content-exclusion and file-ignore features were built for the old world of inline completions and chat. In agent mode, an assistant calls tools — it reads files, greps the tree, runs shell commands — and those code paths often bypass the platform's exclusion rules. If you block a file from completions but the agent can still git show it, the file is not actually protected. Two practical consequences:

• Secrets in context are secrets sent. An agent that reads a .env, a config file, or a log with a token in it has just put that secret in a prompt. Keep credentials out of the working tree, not just out of git.
• Prompt injection is real. Instructions hidden in a README, a dependency, or a pasted issue can steer an agent into reading and exfiltrating data. The more autonomy you grant, the more this matters.

The only real guarantee: run it locally

Every cloud tier above is a promise about what a company will and will not do with code you nonetheless sent them. If your requirement is that the code never leaves your machine, no promise is equivalent to no transmission. That is what a local model gives you:

• Ollama or LM Studio + Continue. A local runtime serving an open-weight model, wired into VS Code or JetBrains via the Continue extension. Inference happens on your hardware.
• Tabby. A self-hosted completion server you can run on a workstation or an on-prem box for a whole team.
• llama.cpp. The low-level runtime under much of the local-model ecosystem, if you want maximum control.

The trade is real — a 7-to-70-billion-parameter local model is not frontier-class, and you supply the GPU or the patience. But the privacy guarantee is absolute and, crucially, verifiable: open your network monitor, use the assistant, and confirm zero outbound requests. That is the exact test we recommend for any tool that claims to be private — the same one we invite you to run on this site's tools.

A decision framework by data sensitivity

You do not need the strictest option for everything. Match the tier to what the code actually is:

A 10-minute lockdown checklist

1. Sign work machines into work accounts only. No personal ChatGPT/Claude/Copilot logins on a device that touches proprietary code.
2. Confirm you are on a commercial/enterprise tier with a no-training commitment — not a personal subscription.
3. Enable the privacy switch where one exists: Cursor Privacy Mode on, Claude/ChatGPT training toggles off, Copilot snippet setting off.
4. Add content exclusion / ignore files for secrets and sensitive paths — and remember they may not cover agent mode.
5. Keep secrets out of the working tree. Anything an agent can read, it can send. Decode and inspect tokens locally with a tool like the JWT decoder instead of pasting them into a chat.
6. For your most sensitive repos, go local. Stand up a local model and verify zero egress in your network monitor.

Where a site like this one fits

A surprising amount of what people paste into an AI chat does not need a model at all — it needs a deterministic tool. Decoding a JWT, hashing a string, generating a secure password, formatting a JSON blob, testing a regex: these are exact, well-defined operations with a single correct answer, and doing them locally means the sensitive input never leaves your tab. Reach for the JWT decoder, hash generator, password generator, JSON formatter or regex testerbefore you hand a secret to someone else's server. It is the same principle as a local model, applied to the small stuff: the safest data is the data you never transmit.

For the bigger picture on why local-first is the right default, see why offline-first developer tools matter, and if you are building whole features with AI, read how to vibe-code safely next.