Aligning the deliverables…
Circling back, looping in, and touching base.
Please do not alt-tab — legal is watching.
Aligning the deliverables…
Circling back, looping in, and touching base.
Please do not alt-tab — legal is watching.
GecoveauYour data has abandonment issues. It leaves. It doesn't always say where. We checked.
Your AI coding tool reads every line you write. Some vendors train on it. Some keep it for years. Some never see it. Geco-View grades 42 tools and plans on four things: training, retention, telemetry, and whether you can run it offline, using only what each vendor publishes in its own docs. No vibes. No guesses. If a vendor doesn't say, we mark it Not published and move on.
Last checked: Oct 19, 2026 · How we grade · What changed
The short version:
--oss mode.Since local wins, a word from the people writing this page.
The Keep puts local AI, encrypted documents, and useful task tools in one desktop app. Keep your business YOUR business. The power of AI, with you in control.
Coming soon.
Full disclosure: we make The Keep. Grades use the same rubric for everyone. The Keep isn't graded here. It doesn't have public data-handling docs to grade yet, and we don't grade on promises, including our own.
Sort by grade. Filter by "trains by default". Click any row for opt-out steps and sources.
Read this before you judge anyone. Grades reflect only what each vendor publishes in its own docs, as of the checked date on each entry. Not published means we couldn't find it in official sources, not that the vendor does anything bad. Vendors: spot a gap or an error? Send a correction with a link to your source and we'll re-check it.
| Augment Code Community | F | Yes, no opt-out | Not published | no | On, no off switch | 2026-10-19 |
| Cursor Individual: Privacy Mode OFF | F | Yes, no opt-out | Not published | no | Not published | 2026-10-19 |
| Windsurf (now Devin Desktop)rebranded Free | F | Yes, no opt-out | Long / indefinite | no | Not published | 2026-10-19 |
| Replit Self-serve plans other than Pro | F | Yes, no opt-out | Not published | no | Not published | 2026-10-19 |
| Cline Cline / ClinePass provider (Cline-supplied keys) | F | Not published | Not published | no | Can include code/prompts | 2026-10-19 |
| Kilo Code Kilo Gateway free models / Auto Free | F | Yes, no opt-out | Not published | no | On, can disable | 2026-10-19 |
| OpenCode OpenCode Zen gateway | F | Not published | Not published | no | Not published | 2026-10-19 |
| GitHub Copilot Free | F | Yes, unless you opt out | Not published | no | Not published | 2026-10-19 |
| GitHub Copilot Pro | F | Yes, unless you opt out | Not published | no | Not published | 2026-10-19 |
| GitHub Copilot Pro+ | F | Yes, unless you opt out | Not published | no | Not published | 2026-10-19 |
| GitHub Copilot Max | F | Yes, unless you opt out | Not published | no | Not published | 2026-10-19 |
| Windsurf (now Devin Desktop)rebranded Pro / Max / Teams | F | Yes, unless you opt out | Long / indefinite | no | Not published | 2026-10-19 |
| Replit Pro | F | Yes, unless you opt out | Not published | no | Not published | 2026-10-19 |
| Amazon Kiro Free Tier & individual subscribers (Builder ID / social login) | F | Yes, unless you opt out | Not published | no | On, can disable | 2026-10-19 |
| Amazon Q Developer Free tier | F | Yes, unless you opt out | Not published | no | On, can disable | 2026-10-19 |
| JetBrains AI Assistant / Junie Individual non-commercial license | F | Yes, unless you opt out | Long / indefinite | partial | Can include code/prompts | 2026-10-19 |
| Claude Code Consumer: Free / Pro / Max | F | Choice at signup | Years | no | On, can disable | 2026-10-19 |
| Amp Individual / non-Enterprise | D | Opt-in | Not published | no | Not published | 2026-10-19 |
| OpenAI Codex ChatGPT personal plans (Plus / Pro, also Free / Go) | D | Yes, unless you opt out | Not published | yes | On, can disable | 2026-10-19 |
| OpenCode Own API key or local model | D | Not published | Your provider's | yes | Not published | 2026-10-19 |
| Windsurf (now Devin Desktop)rebranded Enterprise | D | No | Long / indefinite | no | Not published | 2026-10-19 |
| Replit Enterprise | D | No | Not published | no | Not published | 2026-10-19 |
| Augment Code Professional / Enterprise | D | No | Not published | no | Not published | 2026-10-19 |
| Amazon Q Developer Pro tier | C | No | Not published | no | On, can disable | 2026-10-19 |
| GitHub Copilot Business | C | No | ≤ 30 days | no | On, no off switch | 2026-10-19 |
| GitHub Copilot Enterprise | C | No | ≤ 30 days | no | On, no off switch | 2026-10-19 |
| Amp Enterprise | C | No | ≤ 30 days | no | Not published | 2026-10-19 |
| JetBrains AI Assistant / Junie Commercial individual / organization license | C | Opt-in | Not published | partial | None / opt-in | 2026-10-19 |
| Claude Code Commercial: Team / Enterprise / API (incl. Bedrock, Google Cloud) | C | No | ≤ 30 days | no | On, can disable | 2026-10-19 |
| Google Gemini Code Assistwinding down Standard / Enterprise | C | No | Zero / ephemeral | no | On, no off switch | 2026-10-19 |
| Sourcegraph Cody Cody Enterprise | C | No | Zero / ephemeral | Not published | On, no off switch | 2026-10-19 |
| Cursor Individual: Privacy Mode ON | B | No | Zero / ephemeral | no | Not published | 2026-10-19 |
| Cursor Teams / Enterprise | B | No | Zero / ephemeral | no | Not published | 2026-10-19 |
| Amazon Kiro Enterprise (incl. Q Developer Pro via AWS account) | B | No | ≤ 30 days | no | None / opt-in | 2026-10-19 |
| Tabnine SaaS, self-hosted & air-gapped | B | No | Zero / ephemeral | partial | On, no off switch | 2026-10-19 |
| Cline Own API key or local model | A | No | Not collected | partial | On, can disable | 2026-10-19 |
| OpenAI Codex ChatGPT Business / Enterprise / Edu & API | A | No | ≤ 30 days | yes | On, can disable | 2026-10-19 |
| Zed AI Free / Pro / Business | A | Opt-in | Zero / ephemeral | yes | On, can disable | 2026-10-19 |
| Continueunmaintained Open-source extension / CLI | A | No | Your provider's | yes | None / opt-in | 2026-10-19 |
| Tabby Self-hosted (open source) | A | No | Not collected | yes | On, can disable | 2026-10-19 |
| Kilo Code Own API key or local model | A | No | Not collected | yes | On, can disable | 2026-10-19 |
| Aider Open-source CLI | A | No | Not collected | yes | None / opt-in | 2026-10-19 |
Every policy on this page can change with a blog post. GitHub flipped Copilot's individual plans to train-by-default with 30 days' notice. The only setup no vendor can change on you is one where your code never leaves your machine.
How to get there:
--oss) all document local-model setups. Tabby gives a team a self-hosted server. JetBrains AI Assistant supports local models for chat.aider --analytics-disable, KILO_TELEMETRY_LEVEL=off, Zed "telemetry": {"diagnostics": false, "metrics": false}, Codex [analytics] enabled = false, TABBY_DISABLE_USAGE_COLLECTION=1.Sources (checked Oct 19, 2026): Aider + Ollama · Kilo Code + Ollama · Cline local models · Zed local models · Codex OSS mode · Tabby · JetBrains local models
Dated, sourced policy events. 'page_revision' entries reflect a vendor's own 'last updated' date where the vendor didn't itemize the change. Dates are as published by the vendor.
Geco-View grades each tool and plan on what happens to your code, out of 100 points. Grades come only from the vendor's own published docs, terms and policies, checked 2026-10-19. Every grade on the page is computed from the weights and caps below, the same way for every entry.
Rule zero: undocumented earns little credit. If we can't find something in a vendor's official sources, we mark it Not published and it gets the low fixed score shown in each table below (8 of 40 for training, 6 of 25 for retention, 5 of 15 for telemetry, 0 of 20 for offline). That isn't an accusation. It means the vendor hasn't put it in writing where we could find it, and we don't give full points for things nobody has put in writing. Vendors can fix it by publishing it, then sending us the link.
Gecoveau sells a local-AI desktop app, The Keep. You should know that before you read the weights, because one of them favors local tools: offline/local-model ability is worth 20 of 100 points.
Why it's in the rubric: code that never leaves your machine can't be trained on, retained or leaked by a vendor. That's the strongest privacy guarantee a coding tool can offer, whoever makes it.
Every other criterion (training, retention, telemetry) is scored the same way for every vendor. The Keep isn't graded on this page. It doesn't have public data-handling docs to grade yet, and we don't grade on promises, including our own.
| Category | Max points | Why it matters |
|---|---|---|
| Training default | 40 | Whether your code ends up inside someone's model |
| Retention | 25 | How long your prompts and code sit on someone else's servers |
| Offline / local-model ability | 20 | Whether you can cut the cord entirely |
| Telemetry | 15 | What the client phones home with, and whether you can stop it |
| Class | Points | Meaning |
|---|---|---|
no | 40 | Vendor says it doesn't train on your code (by policy or contract), or never receives it |
opt-in | 34 | Training only if you explicitly turn it on |
choice-at-signup | 20 | You must pick at signup, and the vendor doesn't say which way the toggle is preset |
opt-out default-on | 12 | Trains unless you find the switch |
| Not published | 8 | The vendor's official sources don't say |
yes | 0 | Trains, and you can't turn it off on this plan |
| Class | Points | Meaning |
|---|---|---|
none-by-vendor | 25 | Vendor says it doesn't collect or store your prompts/code (e.g. bring-your-own-key clients) |
zero-or-ephemeral | 25 | Stateless, zero data retention, or deleted right after the response |
le-30-days | 17 | Kept 30 days or less by default |
provider-dependent | 17 | Local client; retention depends on the model provider you pick, and the vendor makes no explicit no-collection statement |
admin-configurable | 14 | An org admin sets retention |
long-or-indefinite | 6 | Kept "for the duration of the relationship", "as long as needed", or more than 30 days up to 2 years |
| Not published | 6 | No retention period in the vendor's official sources |
multi-year | 3 | Kept for years (e.g. 5 years) |
When retention depends on a setting, we score the default branch. If the default isn't published, we score the worse branch.
| Class | Points | Meaning |
|---|---|---|
none-or-opt-in | 15 | No telemetry, or off unless you opt in |
default-on-documented-opt-out | 10 | On by default, excludes code/prompts, with a documented off switch |
| Not published | 5 | Client telemetry isn't described in the vendor's official sources |
default-on-no-documented-opt-out | 4 | On by default with no documented user off switch |
includes-code-or-prompts | 2 | Telemetry or analytics can include code, prompts or full LLM inputs/outputs |
| Value | Points | Meaning |
|---|---|---|
yes | 20 | Vendor documents running against a local model / self-hosted server with nothing required from the vendor's cloud |
partial | 10 | Local models work for some features, or the app still calls home (e.g. feature flags, agents not supported) |
no / Not published | 0 | Cloud only, or offline use isn't documented |
| Grade | Score |
|---|---|
| A | 85–100 |
| B | 70–84 |
| C | 55–69 |
| D | 40–54 |
| F | 0–39 |
Straight answers to the questions people actually type into search bars, taken from the vendors' own docs. Sources under every answer. Not legal advice; just what's in writing.
Only if Privacy Mode is off. With Privacy Mode on, Cursor says your code "will not be used for training" and it has zero-data-retention agreements with all model providers. With it off, Cursor "may use and store codebase data, prompts, editor actions, code snippets" to train its models. Privacy Mode is on by default for teams, and admins can enforce it. To turn it on: Cursor Settings (Cmd/Ctrl+Shift+J) > General > Privacy Mode. Cursor doesn't publish the default for individual accounts, so check yours. Sources: Cursor Data Use & Privacy Overview (updated Sep 3, 2026) · Cursor Help: Privacy (checked Oct 19, 2026)
On Free, Pro, Pro+ and Max: yes, by default, since Apr 24, 2026. That covers inputs, outputs, code snippets, surrounding context, file names and repo structure. On Business and Enterprise: no, by contract. To opt out: github.com > your avatar > Copilot settings > "Allow GitHub to use my data for AI model training" > Disabled. If you opted out of the old product-improvement setting before, your choice carried over. Sources: GitHub blog (Mar 25, 2026) · GitHub Docs (checked Oct 19, 2026)
On Business and Enterprise, prompts and suggestions from IDE chat and code completions aren't retained. Copilot on github.com, mobile and CLI keeps them 28 days, and engagement data is kept two years. GitHub doesn't publish retention for individual plans. Source: GitHub Copilot plans & FAQ (checked Oct 19, 2026)
It depends on your plan. On consumer Free/Pro/Max, if you allow training your sessions are kept 5 years. If you don't, 30 days. On Team, Enterprise and API, the standard is 30 days, with zero data retention for qualified Claude for Enterprise orgs. /feedback and /bug transcripts are kept 5 years on any plan. Claude Code also keeps local transcripts on your machine for 30 days by default. Sources: Claude Code docs: Data usage (checked Oct 19, 2026) · Anthropic consumer terms update (Aug 28, 2025)
Under Commercial Terms (Team, Enterprise, API, Bedrock, Google Cloud): no. On Free, Pro and Max, only if the model-improvement setting is on. You pick at signup and can change it at claude.ai/settings/data-privacy-controls. Sources: Claude Code docs (checked Oct 19, 2026) · Anthropic (Aug 28, 2025)
Set CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1, or individually DISABLE_TELEMETRY=1, DISABLE_ERROR_REPORTING=1, DISABLE_FEEDBACK_COMMAND=1. Metrics never include code, prompts or file paths, according to Anthropic. Source: Claude Code docs (checked Oct 19, 2026)
On personal ChatGPT plans, yes, unless you opt out. Turn off Settings > Data controls > Improve the model for everyone, then turn off Include environments in Codex settings (it's separate). On Business, Enterprise, Edu and the API, OpenAI doesn't train on your data by default. Sources: OpenAI Data controls (checked Oct 19, 2026) · OpenAI: How your data is used (updated Mar 13, 2026) · Enterprise privacy (updated Jan 8, 2026)
Windsurf now redirects to Cognition's Devin Desktop. Cognition's policy: by default it may use your data for model training. Paid plans can opt out in Data Controls (Teams: admin only), and that also enables ZDR with model providers. Free has no documented opt-out. Enterprise: never without written consent. Source: Cognition security docs (checked Oct 19, 2026)
Standard and Enterprise: no, and they're stateless (prompts aren't stored unless you turn on logging). But Google stopped selling new Standard/Enterprise subscriptions on Oct 9, 2026, and the free individual tier shut down on Jun 18, 2026. Sources: Google Cloud data governance (updated Oct 13, 2026) · Gemini Code Assist deprecations (checked Oct 19, 2026)
On non-commercial licenses, JetBrains can collect "detailed code-related data" (full LLM inputs and outputs, including code) by default and use it to train models. You can opt out in settings. On commercial and organization licenses it's opt-in only. The data is kept 1 year. Source: JetBrains Product Data Collection notice v1.6 (Jul 7, 2026)
Top of the table: Aider (never collects code, analytics opt-in), Tabby (self-hosted), Kilo Code and Cline with your own key or a local model, Zed (opt-in only, local models supported), and Continue (now unmaintained). On cloud tools, the business tiers of Copilot, Claude Code, Codex, Cursor (Privacy Mode), Kiro, Q Developer Pro, Tabnine and Gemini Code Assist don't train. See each row for sources.
We couldn't find it in the vendor's official sources. It doesn't mean the vendor does anything bad. It means they haven't put it in writing where we could find it. We don't fill gaps with guesses, and undocumented answers earn little credit: Not published gets a low fixed score in each category, and zero for offline. If you're the vendor, publish it and send us the link with your correction. We'll re-check it.
We re-check every source page weekly and log changes in the changelog. Each entry shows the date it was last checked, and each changelog entry has its date and sources.