Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more

Most AI coding assistants send your prompt and task-relevant code context to a cloud service for inference. That can include nearby file snippets, filenames, comments, cursor position, repository structure, editor actions and your accepted or edited output. Turning off model training, enabling a privacy mode or disabling editor telemetry changes different parts of the data flow; none of those settings automatically makes inference local. The safest approach is to identify your account edition and active features, disable optional model improvement, restrict agent repository access, block sensitive files from file tools and review feedback and telemetry separately. The controls below reflect vendor documentation checked October 30, 2026, and may change as product labels and provider arrangements change.

What data is sent to AI providers?

The payload is usually more than the sentence typed into a chat box. A coding assistant may transmit the prompt, selected code, open-file and adjacent-file snippets, comments, documentation, filenames, repository structure, cursor location, conversation history, generated responses, accepted or modified suggestions and feature-interaction metadata. GitHub, Cursor and Google document these categories in different terms, and the exact payload depends on the feature and account edition.

Ordinary completion normally uses a bounded context window rather than uploading every file in a repository. However, chat, edit, indexing, retrieval and agent modes can request additional files. A cloud coding agent is a separate risk category: it may need a repository copy, a workspace snapshot or broader file access to plan and execute changes. Ask six questions for every assistant and mode:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
  1. Payload: Which prompts, files, metadata and outputs leave the device?
  2. Processing party and location: Does the assistant, a model provider or another integration process the request, and in which jurisdiction?
  3. Training permission: May the material improve models, and does the answer differ by plan?
  4. Retention: How long are prompts, files, transcripts, logs or safety records kept, and what exceptions apply?
  5. Telemetry and feedback: Are usage metrics, error reports, ratings or submitted conversations collected separately?
  6. Agent scope: Can a hosted agent clone a repository, run commands, access secrets or contact third-party services?

“Encrypted,” “zero data retention,” “not used for training,” “local file access” and “local model execution” are different claims. A provider can encrypt a request in transit and still process it in the cloud; a service can promise no training while retaining a short-lived request for abuse prevention or debugging.

Popular on Amazon
Elebase USB to USB C Adapter for iPhone 18 Pro Max,USBC Car Charger Adapter | 4Pack Type C Female to A Male Cable Converter for Apple Duo 17 16 15 14 Plus,iWatch Watch 12 11 10,iPad 9 8 Air,Airpods 5 4
  • Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
  • Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
  • Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
  • Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
  • 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.

Is my code used for training?

There is no single industry-wide answer. Individual, organizational and API accounts can have different defaults, and safety-review or feedback exceptions may survive a no-training choice. Check the account and feature actually in use rather than relying on the editor’s brand name.

Assistant or mode Documented data and training position Controls and limitations
GitHub Copilot individual GitHub says interaction data can include inputs, surrounding code, comments, documentation, filenames, repository structure, navigation, feature interactions, ratings and accepted or modified outputs. From April 24, 2026, individual Free, Pro and Pro+ users (and current instructions that include Copilot Max) can opt out of model training. Profile picture → Copilot settings → set Allow GitHub to use my data for AI model training to Disabled. This stops the specified training use, not cloud inference. Cloud-agent repository access has separate No repositories and Only selected repositories choices.
GitHub Copilot Business and Enterprise GitHub states these plans are not affected by the 2026 individual-plan update and are treated differently for model training. Organization policies and content exclusion still need review. Exclusion does not currently cover IDE Chat Edit and Agent modes, and GitHub documents symlink and remote-filesystem limitations.
Cursor With Privacy Mode enabled, Cursor says code is not used for training by Cursor or its providers, while prompts and code context still go to model providers. With it off, Cursor says it may store and use codebase data, prompts, editor actions and snippets for improvement and training. Settings → General → enable Privacy Mode. Your own API key does not bypass Cursor’s backend. Optional Cloud Agents temporarily store encrypted repository copies while an agent runs.
Claude Code Consumer Free, Pro and Max accounts make model improvement a choice; Anthropic says commercial Team, Enterprise and API prompts and code are generally not used to train generative models without an affirmative customer choice. Consumer safety-review and feedback exceptions remain relevant. Use file-tool deny rules, telemetry variables and a separate review of hosted cloud sessions. A cloud session clones the repository into an isolated virtual machine and keeps a transcript for later access.
Gemini Code Assist Standard and Enterprise Google lists developer queries, responses, conversation history, open and adjacent file snippets and cursor location as Customer Data, and says it does not use that data to train models without permission. Apply the terms for the specific Standard or Enterprise edition. Do not extend this documented assurance to the individual edition without checking its current notice.

These are documented policies, not a measurement of network traffic. Vendors can change model providers, retention periods, interfaces and defaults, so re-open the linked policy pages when an account, plan or feature changes.

How do I change GitHub Copilot privacy settings?

For an individual account, disable optional training first, then restrict hosted-agent access. These choices are independent: a request can still be sent for inference after training is disabled.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
  1. Sign in to GitHub and open your profile menu.
  2. Select Copilot settings.
  3. Find Allow GitHub to use my data for AI model training and set it to Disabled. GitHub announced the individual-plan change on March 25, 2026, with the new policy effective April 24, 2026; check the current page for the label shown on your account. GitHub’s announcement explains the scope.
  4. In cloud-agent repository access, choose No repositories unless an agent is required. If it is required, choose Only selected repositories and grant the smallest set.
  5. Review partner-agent controls before enabling an integration. A third-party agent can have terms, logs and retention separate from Copilot.

Organizations should also examine Copilot content exclusion. It can keep specified files from informing covered Copilot features, but GitHub says it does not currently cover IDE Chat Edit and Agent modes. Semantic information may reach Copilot indirectly through an IDE, and exclusions have stated limitations for symlinks and remote filesystems. Treat exclusion as a guardrail, not a secret filter.

A private repository at rest is not automatically private during active Copilot use. The relevant question is whether code from that repository is included in the request generated by the feature you invoked.

Does Privacy Mode stop your code going to the cloud?

No. Cursor’s Privacy Mode changes training and storage terms, but Cursor still sends prompts and code context to model providers for cloud inference. It is useful when the requirement is “do not use my code to train,” not when the requirement is “the code must never leave this machine.”

  • Open Cursor Settings → General and enable Privacy Mode. Organizations can enforce it.
  • Confirm the mode for every account and workspace you use; a personal setting and an organization policy can differ.
  • Do not assume a personal API key makes requests direct. Cursor states, “Even if you use your API key, your requests will still go through our backend!” See the Cursor data-use documentation.
  • Check model-specific retention. Cursor’s zero-data-retention arrangements do not automatically apply to user-provided API keys, and some models require separate retention approval.
  • Keep optional Cloud Agents off when repository copies in a hosted environment are prohibited. Cursor describes encrypted copies stored temporarily while an agent runs and deleted after completion; that is still cloud storage during execution.

Privacy Mode therefore addresses model improvement and certain retention arrangements, while network egress remains necessary for the normal hosted assistant.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Also popular on Amazon
Anker USB-C Hub, 5-in-1 USB Hub for Laptops, 4K HDMI Multiport Adapter | USB C Dongle with 90W Max Power Delivery, 3×5Gbps USB A Data Ports, for MacBook, Dell, and More (Charger Not Included)
  • 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
  • 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
  • Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
  • 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
  • What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.

How do I keep secrets and .env files out of the conversation?

Preventing a file from being read is stronger than hoping the model ignores a secret after it is indexed. Use repository rules, file-tool restrictions and operating-system secret hygiene together.

Claude Code project rules

Claude Code supports Read deny rules for file tools. Examples include:

Read(./.env)
Read(./secrets/**)
Read(./config/production/**)

Place rules according to the project’s documented settings mechanism and verify that they apply to the session and working directory. Anthropic says .claudeignore has no effect, so creating that file is not a substitute for Read denies.

General repository controls

  • Keep credentials outside the repository and load them through a secret manager or environment injection at runtime.
  • Use a dedicated development account with least-privilege tokens; revoke and rotate any credential that may have appeared in a prompt, log or transcript.
  • Do not paste production keys into chat, issue comments, feedback forms or model-evaluation prompts.
  • Review staged diffs and generated patches before accepting them. An output can repeat a secret that was already present in context.
  • Separate sensitive repositories or directories so an agent cannot traverse them accidentally.

File exclusions are feature-specific. An exclusion that works for autocomplete may not cover chat, edit, indexing, agent or a third-party extension. Check the mode being used, especially when a tool can search the workspace.

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

What telemetry remains after I turn settings off?

Telemetry, error reporting, training and inference are separate channels. Turning off one does not disable the others.

For Claude Code, set the documented environment variables before launching a session when those controls fit your organization’s policy:

DISABLE_TELEMETRY=1
DISABLE_ERROR_REPORTING=1
CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1

Anthropic says its metrics exclude code, prompts and file paths, but these variables do not turn cloud inference into local inference. The first opts out of usage metrics, the second of qualifying error reports, and the third disables non-essential traffic. Review feedback dialogs separately: submitting a rating, transcript or error attachment can create a new data flow even after ordinary telemetry is disabled.

Also popular on Amazon
Sale
Anker USB C Hub, 7in1 Multi-Port USB Adapter, 4K@60Hz USBC to HDMI Splitter | 85W Max PD, 2 USB 3.0 & 1 USBC Data Ports, SD/TF Card Reader, for Laptops/Mac and Other Type C Devices (Charger Not Included)
  • Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
  • Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
  • Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
  • Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
  • What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.

In VS Code, set Settings → Telemetry → Telemetry Level to off, or set "telemetry.telemetryLevel": "off" in settings JSON. Microsoft warns that extensions can collect telemetry independently, so this setting stops future VS Code telemetry but does not automatically stop Copilot or another extension’s collection. Inspect each extension’s account and privacy controls.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

A former Windsurf help URL now redirects to Devin Desktop documentation, which mentions an account-level opt-out for code-snippet telemetry. That redirect is not enough evidence for a complete, current Windsurf training or retention comparison; do not infer that the two products have identical policies.

What does Claude Code send, and how do hosted sessions differ?

Start with the login type. Consumer Free, Pro and Max accounts, commercial Team and Enterprise accounts, and API usage can have different terms. Anthropic describes commercial prompts and code as generally excluded from generative-model training unless a customer affirmatively chooses otherwise; consumer model improvement is a choice, with safety-review and feedback exceptions.

Local Claude Code can read files through its tools and send relevant content for inference. A hosted cloud session is different: Anthropic says it clones the repository into an isolated virtual machine and stores a transcript for later access. If repository copies or transcripts are prohibited, use a local-only workflow or do not start the hosted session.

Anthropic’s stated retention categories are not one universal period: opted-in consumer data may remain in de-identified model-training pipelines for up to five years; flagged inputs and outputs up to two years; and flagged trust-and-safety classification scores up to seven years. Those periods apply to the specified categories, not to every prompt or file.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

What does Gemini Code Assist collect?

For Standard and Enterprise editions, Google identifies Customer Data as developer queries, responses, conversation history, snippets from files open and adjacent in the IDE, and cursor location. It separately describes service analytics and technical telemetry. Google states, “Google doesn’t use your data to train our models without your permission,” within the Standard and Enterprise documentation.

That statement is edition-scoped. Confirm the terms for an individual Gemini Code Assist account before assuming the same model-improvement opt-out or retention rules. The documented materials do not establish an exact individual-edition opt-out, so treat it as an open account-specific check rather than a universal setting.

Also popular on Amazon
Sale
UGREEN USB to USB C Adapter Combo 4-Pack, 10Gbps USB C Converter Space Gray | Data transfer & Fast charging for MacBook, iPhone 17/16/15, iPad, Samsung Galaxy, Apple Watch
  • Dual Converters, Infinite Potential:Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
  • Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
  • Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
  • Widely Compatible: Transform any USB-C port into a USB-A port and USB-A port into a USB-C port, and connect up a wide range of USB-C(including MacBook, iPad Pro/Air/Mini, iPhone models with USB C ports, Samsung Galaxy series, and Google Pixel series. ) and USB A devices(including external hard drives, phones, mice, printers, and more)
  • Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft

Can Copilot read my private repository?

It can receive private-repository code when an active Copilot feature includes that code in its context or when a permitted cloud agent accesses the repository. “Private” controls who can access the repository on GitHub; it does not mean no code is transmitted during an authorized assistant request.

For cloud agents, set repository access to No repositories or Only selected repositories. For ordinary IDE use, inspect which files are open, adjacent, indexed or selected before invoking chat or edit. Apply organizational content exclusion where appropriate, but remember its documented gaps for IDE Chat Edit and Agent modes, semantic information passed through the IDE, symlinks and remote filesystems.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Does turning off VS Code telemetry stop Copilot?

No. The VS Code telemetry switch controls telemetry generated by VS Code itself. Copilot and other extensions can have independent collection, inference, feedback and account settings, so disable or configure each extension separately.

After setting telemetry.telemetryLevel to off, review extension documentation, organization policies and assistant-account settings. Also distinguish telemetry from prompt transmission: an assistant may send code context for a completion even when editor telemetry is disabled.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

What is the safest practical configuration?

Use this sequence whenever you add an assistant, change plans or enable an agent:

  1. Identify the exact account and edition. Record whether it is an individual, team, enterprise or API account.
  2. List enabled features. Separate autocomplete, chat, edit, indexing, repository search, cloud agents and third-party agents.
  3. Disable optional model improvement. Save a screenshot or policy record showing the account-level choice.
  4. Enable the product’s privacy mode. For Cursor, turn on Privacy Mode; for other products, use the documented equivalent and verify its scope.
  5. Restrict repository access. Set Copilot cloud agents to no repositories or selected repositories, and avoid hosted agents where temporary copies are unacceptable.
  6. Deny sensitive paths. In Claude Code, use Read deny rules for .env, secret directories and production configuration. Use equivalent controls in other tools.
  7. Reduce independent telemetry. Turn off VS Code telemetry and configure extension metrics and error reporting separately.
  8. Audit feedback. Read what a rating, diagnostic bundle or conversation attachment contains before submitting it.
  9. Recheck after updates. Policy dates, model providers, retention exceptions and UI labels can change without changing the editor’s name.

For highly regulated or genuinely secret code, policy controls may be insufficient. Require an approved deployment model, network egress rules, contractual terms and a local or self-hosted inference option validated by your security team. “No training” is valuable, but it is not the same as “no cloud processing.”

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

How should teams document an assistant’s privacy posture?

Create a short record for each approved tool: account edition, enabled modes, model providers, payload categories, training choice, retention and safety exceptions, telemetry settings, repository scope, secret-file rules and owner responsible for reviewing policy changes. Add a rule that developers must not submit credentials or regulated personal data in prompts or feedback.

Also popular on Amazon
Sale
Anker USB C Hub, 5-in-1 USBC to HDMI Splitter with 4K Display | 85W Max PD, 1 Powered USB-C 5Gbps & 2 Powered USB-A 3.0 5Gbps Data Ports, for MacBook Pro, MacBook Air, Dell and More (Black)
  • 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
  • Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
  • Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
  • HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
  • What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.

When a vendor changes a policy, compare the new text against that record rather than relying on a marketing label. A plan can retain its “enterprise” name while adding a new agent, integration or model route with separate terms. Reapproval should cover the new feature, not just the base autocomplete.

Bottom line: Assume an AI coding assistant sends whatever context its active feature needs to a cloud service unless documentation proves local execution. Disable training where offered, but also control retention, telemetry, feedback, agent repository access and sensitive-file reads. The strongest practical setup combines least-privilege repositories, explicit deny rules and a review of every account edition and integration.

Frequently Asked Questions

Does encryption prevent an AI provider from seeing my source code?

No. Encryption protects data in transit or at rest, but the service must generally decrypt and process the request to generate a completion. Ask separately where decryption occurs, who can access the plaintext and how long it is retained.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Will using my own model API key keep requests off the assistant vendor’s servers?

Not necessarily. Cursor explicitly says requests made with a user-provided API key still pass through its backend. Check the assistant’s routing documentation before treating a personal key as a direct connection.

Can an organization force developers to use privacy settings?

Some products provide organization enforcement, such as Cursor’s enforceable Privacy Mode and GitHub organization policies. Enforcement is usually feature- and plan-specific, so administrators should verify cloud-agent scope, exclusions and extension behavior rather than relying on a single global switch.

What should I do if a secret was pasted into an AI coding chat?

Revoke and rotate the exposed credential immediately, then inspect repository history, assistant transcripts, feedback submissions and logs covered by the account. Removing the message afterward may not remove provider backups, safety records or already generated outputs, so follow the vendor’s deletion and incident procedures.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.