What data does an AI coding assistant actually send, and is your code used for training?

The three questions that actually matter

Most discussion of AI coding tool privacy collapses several different questions into one. Separating them makes the answer checkable.

First: does my code leave my machine? For any cloud-backed assistant, yes. Anthropic's documentation states that Claude Code runs locally but sends data over the network to interact with the model, including all user prompts and model outputs, encrypted in transit with TLS 1.2 or later. The only way to avoid this is a locally hosted model, which is a different tradeoff.

Second: is it retained, and for how long? This is where account tier decides the answer. Third: is it used to train a model? Also decided by tier and setting. A tool can be entirely reasonable on the third question and still retain data for a period you are not comfortable with, so do not treat them as the same question.

A worked example: what the Claude Code docs actually say

On training, Anthropic distinguishes two groups. For consumer users on Free, Pro and Max plans, the documentation says users are given the choice to allow their data to be used to improve future Claude models, and that Anthropic will train new models using data from those accounts when the setting is on, including when Claude Code is used from them. For commercial users on Team, Enterprise, API and third-party platforms, the stated policy is that Anthropic does not train generative models using code or prompts sent to Claude Code under commercial terms, unless the customer has chosen to provide data through the Development Partner Program.

On retention, the same split applies with concrete numbers. Consumer users who allow data use for model improvement get a five-year retention period; consumer users who do not get thirty days. Commercial users get a thirty-day standard retention period, with zero data retention available to qualified accounts on Claude for Enterprise, which the documentation is explicit is not part of the standard Enterprise plan and is enabled per organisation after an eligibility check.

There is also a local component that people routinely forget. The documentation states that Claude Code clients store session transcripts locally in plaintext under a directory in your home folder for thirty days by default, to enable session resumption, with a setting to adjust the period. Plaintext transcripts on disk are part of your exposure even when nothing is being retained server-side.

The channels that are not the model call

Beyond the prompts themselves, documented traffic falls into a few named categories, each with its own default and opt-out. Usage metrics cover latency, reliability and usage patterns; Anthropic's documentation states these never include your code, prompts or file paths, and names the environment variable that disables them. Error reports carry error messages and stack traces from the tool's own internals to a third-party error tracking service, with known secret patterns, file paths, email addresses and other personal information redacted before anything leaves the machine, and a separate opt-out variable.

Feedback commands are the channel most worth understanding, because this one does send code. The documentation states that running the feedback command sends a copy of your conversation history including code to Anthropic, that the bug and share commands submit through the same path, and that you choose how much history to include, with the current session only as the default. Transcripts shared this way are retained for five years. There is a named environment variable to disable it.

There is also an optional prompt asking whether Anthropic can look at your session transcript. The documentation is specific about what selecting yes does: it uploads the conversation transcript, subagent transcripts and the raw session log file, with known API key and token patterns redacted but source code and file contents uploaded as-is, retained up to six months. It also states nothing is uploaded unless you explicitly select yes, and that responses to that survey cannot be used to train models.

One check runs regardless of provider and is worth knowing about because it surprises people on locked-down networks: before fetching a URL, the web fetch tool sends the hostname, not the full URL or page contents, to Anthropic to check against a safety blocklist. The documentation notes this is unaffected by the general non-essential traffic switch and has its own separate setting.

The same split shows up at other vendors

The consumer-versus-commercial pattern is not one vendor's quirk. GitHub's published documentation on how models are hosted for Copilot states that GitHub does not use Copilot Business or Copilot Enterprise customer data to train AI models, while for individual subscribers on Copilot Free, Pro, Pro+ and Max, GitHub may use Copilot interaction data including prompts, suggestions and code snippets generated during sessions to train and improve AI models, subject to user settings. Individual subscribers can opt out, and the documentation links the setting.

That page is also a good illustration of why the model you pick inside a tool can change the answer. It documents provider agreements ensuring data is not used for training across the hosted third-party models, but carries an explicit warning that for two specific Claude models, Anthropic retains data including prompts and outputs by default to operate safety classifiers that detect harmful use, with zero data retention available only to eligible enterprises through a time-bound exemption. Other Claude models on that platform continue to operate under zero data retention.

The general lesson: training policy, retention policy and model choice are three separate dials, and a single sentence like our data is never used for training rarely covers all three.

How to check any other tool

The specifics above apply to one vendor. The method generalises. Look for a documentation page that separately addresses training, retention and telemetry rather than a marketing page that says your data is secure. A vendor that publishes retention periods in days, names its environment variables, and distinguishes consumer from commercial terms is giving you something you can verify and hold them to.

Check which tier you are actually on. This is the single most common source of wrong assumptions. Personal-plan usage on a work machine is frequently governed by consumer terms even when the work is commercial, and the training default may differ from what your employer assumes.

Check whether routing through a cloud provider changes the defaults. Anthropic's documentation includes a table showing that metrics, error reporting and feedback reporting default to off when using Amazon Bedrock, Google Cloud's Agent Platform, Microsoft Foundry or Claude Platform on AWS, while some checks run regardless of provider. Other vendors have similar provider-dependent behaviour; do not assume the defaults you read about apply to your routing.

Check what is stored locally. Plaintext transcripts, caches and log directories are part of your risk surface, especially on shared or managed machines, and they are usually configurable.

If a vendor's documentation does not answer these questions in specific terms, treat that as the answer. Absence of a stated retention period is not the same as no retention.

Limits of this answer

This article uses one vendor's published documentation as a worked example because it is unusually specific, not because it is an endorsement or a ranking. RepoRadar did not test these behaviours by inspecting network traffic; every statement above is drawn from the vendor's own published documentation and can be checked against it directly.

Policies change. Retention periods, defaults and opt-out variables are all things vendors revise, and the documentation page is the authority, not this summary. Check the page before making a policy decision that depends on a specific number.

This answer deliberately does not compare vendors on privacy. Doing that honestly requires each vendor's current terms read side by side at the same moment, and a comparison that goes stale is worse than none. We also make no legal claim here: whether a given configuration satisfies your contractual or regulatory obligations is a question for your own counsel.

A useful next action

Open the data or privacy documentation page for the assistant you actually use, and find four specific things: your plan tier's training default, your plan tier's retention period, the list of telemetry channels with their opt-outs, and where transcripts are written locally.

If you are using a personal plan on work code, that is the finding to act on first. Moving to commercial terms or turning off the model-improvement setting is usually a two-minute change, and it is the one with the largest effect on what happens to your code.