Coding agent data retention is the question every procurement review, privacy assessment and engineering lead eventually asks — and the answers are scattered across dozens of vendor pages that do not use the same words, cover the same tiers, or in some cases exist at all. This census puts six fixed questions to seventeen coding agents and harnesses, using only each vendor’s own published documentation, and reports every cell — including the ones that would not resolve.
The six questions: does repository content leave the local machine in normal operation; what is the stated retention period, by plan tier; is content used for model training by default, and at which tier can you opt out; is a zero-data-retention arrangement published, and for whom; is telemetry separable from code content, with the setting name; and where do the terms actually live. All answers reflect vendor documentation as retrieved on August 17, 2026.
What follows is the method, a status vocabulary that keeps unanswered cells honest, the complete 17-row table, and the patterns the table supports — plus, just as deliberately, the inferences it does not.
- 01All 17 agents transmit code off the machine in at least one common configuration.Even the most local-first, bring-your-own-key tools (Aider, Continue) transmit repository content the moment a cloud model is configured. The question that differentiates vendors is what happens afterwards.
- 028 of 17 rows are flagged unresolved — and the reasons split four ways.Two rows (GitHub Copilot, Grok Build) publish the exact questions but the answers sit behind client-side JavaScript our fetch method could not execute — our limitation, not vendor silence. Three (Kimi Code, Qwen Code, Z.ai’s GLM Coding Plan) had no working product-specific policy page at all, and Continue’s telemetry page 404s. DeepSeek Harness and Z.ai are disclaimed by their own consumer policies. And the code-versus-docs check for Aider and DeepSeek Harness was not run at all. The table labels each kind.
- 03Documentation completeness does not track company size.Tabnine publishes the most granular no-train-no-retain language in the set — context “deleted immediately after the server returns the answer” — and Zed names the one exception to its own zero-retention default, while Cursor and current-era GitHub Copilot publish no exact retention day-count for their standard tiers anywhere this pass could reach.
- 04Training defaults are tier-shaped almost everywhere.Amazon Q trains on Free-tier content by default but not Pro; Windsurf’s opt-out is self-serve on paid plans, admin-only on Teams, and inverts to opt-in on Enterprise; Cursor trains by default unless Privacy Mode is on — free for anyone, but on by default only for Enterprise. A one-word answer per vendor would be wrong.
- 05This is a documentation census, not a verification audit.Every cell records what a vendor publishes, not what independent testing has confirmed. Documented behaviour and verified behaviour are different claims — the reason this table exists in documentation-only form, stated once in the methodology and honoured throughout.
01 — Why This ExistsWhy a documentation census, and not a verdict. #
Nobody buying or auditing a coding agent in 2026 reads one privacy policy. The sources scored in this census include consumer policies that exclude the product’s business tier, enterprise FAQs, security pages, a trust-center document, developer docs and a terms index — and the documents rarely agree on vocabulary. In the sources this pass checked, we could not find any vendor or third party publishing these answers side by side across the category at this width, with one method and one date.
The table records what is documented, and says so plainly, for a specific reason: documented behaviour is not verified behaviour. Our wire-level look at the July 2026 Grok Build incident established that a documented, user-facing privacy control and an actual data flow can diverge — that story is told in full there and is not re-argued here. It is simply the reason this census claims only what vendor pages say, and never presents a published policy as a tested one.
One more reason a dated snapshot matters: these terms sit under companies whose ownership is itself in motion. Cursor’s parent Anysphere became a SpaceX subsidiary when the acquisition closed on August 14, 2026 — covered separately in our read of the close and its first product move — and a policy retrieved before an ownership change is not evidence about the policy after it. Every cell below carries its retrieval date for exactly that reason.
02 — MethodologyA method a stranger could redo, and a vocabulary for the gaps. #
The value of a census is that the gaps are as informative as the answers — but only if the gaps are classified honestly. A page that was read and did not answer, a page that could not be located, and a page whose answer our tools could not render are three different findings, and conflating them would be unfair to vendors and would discredit the table on first inspection. The full method and its known limits:
What was collected. For each of 17 coding agents or agent harnesses, a documented answer to six fixed questions, using only that vendor’s own published material: (1) does repository content leave the local machine in normal operation; (2) the stated retention period for prompts and code, by plan tier; (3) is content used for model training by default, with the opt-out or no-train tier; (4) is zero data retention (ZDR) or an equivalent published, and for whom; (5) is telemetry separable from content, with the setting name where documented; (6) the URL the terms live at, and the retrieval date. All cells reflect vendor documentation as retrieved on August 17, 2026.
Selection rule, fixed before research began. A 15-agent list spanning the four groups the table is banded into: agents from the major AI labs and platforms, model-vendor coding plans, AI editors and IDE agents, and open-source bring-your-own-key clients. Two rows — Amazon Q Developer and Tabnine — were added during research because their documentation answered all six questions in unusual, contrast-worthy detail. No row was dropped once selected, regardless of how the research turned out.
Sources. Vendor-owned domains only: privacy policies, terms of service, developer and enterprise docs, and (for GitHub) the official Trust Center. Press coverage and third-party summaries were never used to answer a cell. Search engines were used only to locate a vendor URL, never to source a cell’s content.
Known limitations. (a) Some vendor FAQs render answers only via client-side JavaScript; where the question text was crawlable but the answer was not, the cell is marked as our fetch limitation, not vendor silence. (b) Consumer policies and API/business terms are often separate documents with different scope at the same company; where only the consumer policy could be located, that scope mismatch is recorded as the finding. (c) This is a documentation census, not a wire-level or source-code audit — documented behaviour is not verified behaviour. For the two open-source rows (Aider; DeepSeek Harness’s runtime), the check of whether the code confirms or contradicts the documentation was not performed in this pass, and those cells say so rather than implying it was. (d) Vendor documentation changes without notice; this is a dated snapshot.
Every cell in the table carries one of six statuses, and the distinction between the last three is the part most comparisons skip:
Documented
The vendor’s own page answers the question. The plan tier the answer applies to is recorded in the cell, because these policies differ by tier almost everywhere.
UND — undocumented
A relevant vendor page was fetched and read in full, and it does not address the question. This is a finding about the documentation, not an inference about the practice.
JS-gated
The vendor publishes the exact question — but the answer sits behind client-side JavaScript our fetch method could not execute. This is our limitation, not vendor silence. A human clicking through may well find the answer.
N/L — page not located
The URL that should carry the answer returns a 404, serves a bare placeholder, or redirects to unrelated content. A broken or missing vendor page is a different, reportable finding.
N/A
The question does not apply to the tool itself — bring-your-own-key clients with no first-party backend inherit whichever provider’s terms the user configures.
Needs research
The dataset spec asked whether open-source products’ code confirms or contradicts their documentation. That code-level check was not performed for Aider or DeepSeek Harness in this pass — flagged rather than silently resolved.
03 — The DatasetThe complete table: 17 agents, six questions. #
The table below is the asset — all 17 rows, no summary substitution. Product names link to the primary source each row was scored against (question six of the census). Cells marked UND, JS-gated or N/L follow the status vocabulary above. Data as of August 17, 2026, retrieved from vendor-owned pages only.
| # | Product (vendor) · primary source | Leaves machine? | Retention (by plan tier) | Trained on by default? Opt-out | ZDR published? For whom | Telemetry separable? Setting |
|---|---|---|---|---|---|---|
| Rows 1–6 · Agents from the major AI labs and platforms | ||||||
| 1 | Claude Code (Anthropic) | |||||
[openai.com/enterprise-privacy](https://openai.com/enterprise-privacy/)
[cursor.com/data-use](https://cursor.com/data-use)2 cells UND · no day-count, no telemetry statement
[copilot.github.trust.page/faq](https://copilot.github.trust.page/faq)Unresolved · JS-gated — our fetch limitation
[docs.x.ai/build/enterprise](https://docs.x.ai/build/enterprise)2 cells JS-gated · FAQ stamped 2025-02-25
[antigravity.google/terms](https://antigravity.google/terms)
alibabacloud.com — billing/setup docs onlyUnresolved · N/L — indexed privacy URL 404s
[docs.z.ai/legal-agreement/privacy-policy](https://docs.z.ai/legal-agreement/privacy-policy)Unresolved · scope-excluded + DPA 404s
[cdn.deepseek.com — open-platform ToS](https://cdn.deepseek.com/policies/en-US/deepseek-open-platform-terms-of-service.html)Unresolved · scope gap + code check not run
[windsurf.com/security](https://windsurf.com/security)
[zed.dev/docs/ai/privacy-and-security](https://zed.dev/docs/ai/privacy-and-security)
[cline.bot/privacy](https://cline.bot/privacy)
[aider.chat/docs/more/analytics.html](https://aider.chat/docs/more/analytics.html)Code-vs-docs check not run
[docs.continue.dev](https://docs.continue.dev)Unresolved · telemetry docs 404
[docs.aws.amazon.com — service improvement](https://docs.aws.amazon.com/amazonq/latest/qdeveloper-ug/service-improvement.html)
[docs.tabnine.com — privacy](https://docs.tabnine.com/main/welcome/readme/privacy)
Two rows share one structural carve-out worth reading together: Anthropic’s provider-level “Covered Models” safety retention (rows 1 and 12) applies wherever those models are served — Zed states plainly that switching to your own API key does not avoid it. We covered the one Claude model tier where zero data retention does not apply in full when the policy landed; the census simply records it as the clearest example of a retention rule that no downstream vendor’s terms can override.
04 — Negative FindingsEight unresolved rows, four different reasons. #
Eight of the 17 rows are flagged unresolved: Kimi Code, Qwen Code, Z.ai’s GLM Coding Plan, GitHub Copilot, Grok Build, DeepSeek Harness, Continue and Aider. In each case the page that should carry the answer could not be located, could not be read, or disclaims the product it was supposed to cover — or a check the method specified was not run. Publishing them unresolved, with the reason classified, is the point: a census that quietly filled these cells by inference would be worthless to exactly the procurement and research readers it exists for. They fail in four ways, three of the eight in two ways at once, and the four support very different conclusions:
JS-gated answers — not vendor silence
GitHub Copilot’s Trust Center FAQ and xAI’s enterprise FAQ both publish the exact questions this census asks — retention duration, training by default — but the answers render only via client-side JavaScript our fetch method could not execute. GitHub in particular plainly does publish specific answers here; this pass simply could not read them.
Broken or missing vendor pages
Kimi Code’s attempted privacy URL serves a bare nginx placeholder; Qwen Code’s search-indexed privacy URL 404s; Z.ai’s cross-referenced Data Processing Addendum 404s; Continue’s telemetry docs 404 despite appearing as a live search result. A policy page that cannot be reached at its own published address is a reportable, dated documentation finding.
Consumer policies that exclude the product
DeepSeek, Z.ai and xAI all write their consumer privacy policies to explicitly exclude API and business use — the exact surface their coding products run on. Where only the consumer policy could be located, the census records the scope mismatch itself as the finding rather than borrowing consumer answers for a product they disclaim.
A check the method specified and this pass did not run
The dataset spec asked whether the two open-source products’ code confirms or contradicts their documentation. That code-level check was not performed for Aider or for DeepSeek Harness’s runtime in this pass, so both rows carry it as an open item rather than a resolved one. Not performed is a different status from indeterminate, and the table keeps them apart.
One clarification the count needs, because a reader checking it will find this immediately: individual UND cells are far more common than those eight rows. On most of the remaining rows — Cursor, Cline, Google Antigravity, Amazon Q Developer and Tabnine among them — a page was reached and read in full and simply does not address one sub-question, usually an exact retention day-count. Those are marked in place, cell by cell, rather than counted as unresolved rows, because a page that was read and did not answer is a different finding from a page that could not be reached, could not be rendered, or disclaims the product. Only one row, Zed, carries no open marker of any kind.
not evidenceof the underlying practice in either direction — and one staleness signal cuts the other way entirely: xAI’s enterprise FAQ carries a “Last updated” stamp of February 25, 2025, which predates Grok Build’s existence. That is a documentation-currency finding about the page, not a data-handling finding about the product.
05 — Tier SplitsTraining defaults are tier-shaped, not vendor-shaped. #
The single most practical pattern in the table: where a training-by-default answer exists at all, it almost never has one value per vendor. It has one value per plan tier — which means every unqualified sentence of the form “vendor X trains on your code” is incomplete, and sometimes wrong, for the tier you are actually on. Three vendors document the pattern explicitly:
Amazon Q Developer
Free tier: content may be used for service improvement by default, with “model training” named as a use and a per-IDE opt-out. Pro tier and Q Business: no content used for service improvement at all, by design — nothing to opt out of.
Windsurf / Devin
Trains by default. Individual paid users can self-serve opt out — which also triggers ZDR with model providers. On Teams, only an administrator can exercise the opt-out. On Enterprise the default inverts entirely: training requires express prior written consent.
Cursor
With Privacy Mode off, codebase data, prompts and editor actions may be used for training by default. Privacy Mode is free for anyone — but on by default only for Enterprise, and admin-enforceable org-wide on Team and Enterprise plans.
“We may use and store codebase data, prompts, editor actions, code snippets, and other code data and actions to improve our AI features and train our models.”— Row 3’s data-use page, dated July 15, 2026, describing default behaviour with Privacy Mode off
The counts, stated with their denominators rather than rounded into “most vendors”: of 17 rows, 14 had a working, product-specific privacy or data-handling page; 3 (Kimi Code, Qwen Code, Z.ai’s GLM Coding Plan) had none this pass could locate; 8 are flagged unresolved. Where ZDR is published at all, it is consistently gated to team, enterprise or approval-based tiers requiring explicit administrative action — this census found no row where zero data retention is a default consumer-tier state.
Product-specific policy located
Rows where a vendor-owned page specific to the product (or explicitly covering it) was reached and read against the six questions.
Kimi Code · Qwen Code · GLM Coding Plan
Rows where no working product-specific privacy page could be located at all — placeholder servers, 404s, or a dead cross-referenced addendum.
Rows flagged unresolved
Kimi Code, Qwen Code, GLM Coding Plan, GitHub Copilot, Grok Build, DeepSeek Harness, Continue and Aider — split across JS-gated answers (our fetch limitation), broken or missing pages, consumer policies that exclude the product’s own scope, and one unexecuted code-vs-docs check.
06 — The SurpriseDocumentation quality does not track company size. #
The two clearest documenters in this census were not the two largest vendors. Tabnine publishes the most granular no-train-no-retain language in the set — context “deleted immediately after the server returns the answer,” even for on-premises and VPC Enterprise deployments, with a separate, numeric one-week window for non-code operational telemetry, the only telemetry day-count found anywhere in the census. Zed names the single exception to its own zero-retention default without hedging, states who imposes it (the model provider), and says plainly that it cannot opt out. Meanwhile Cursor and current-era GitHub Copilot — both far larger companies — publish no exact retention day-count for their standard tiers anywhere this pass could reach.
Grok Build’s enterprise deployment doc deserves its own mention as the best-organized data-lifecycle description in the set: a documented six-phase flow ending with “no prompts, code, or responses are persisted at the inference layer” for ZDR organizations. The same vendor’s enterprise FAQ, one directory over, is JS-gated and stamped with a date that predates the product. Both facts are in the table; a census that kept only one of them would be marketing.
One structural date matters more than any single vendor’s prose: GitHub’s Copilot-specific product terms were formally deprecated on March 5, 2026, replaced for Business and Enterprise direct-from-GitHub purchases by the general GitHub Customer Agreement plus a product-agnostic Data Protection Agreement. Any description of “Copilot’s data terms” written before that date — including the archived promise that prompts are “deleted once Suggestions are generated” — is describing a superseded document.
March 5, 2026— the day the Copilot-specific terms were deprecated. Pre-March descriptions quote a document that no longer governs new Business and Enterprise subscriptions. The current answers exist in GitHub’s Trust Center FAQ; this pass could not render them, so the census leaves those cells open rather than backfilling from the archived terms.
07 — Using The CensusHow to use this table without over-reading it. #
For procurement and security reviews, the table is raw material, not a verdict. Three usage rules keep it honest. First, always carry the tier: a retention or training answer without its plan tier is a different (and usually wrong) claim, so match the row’s tier language to the tier you are actually buying. Second, treat unresolved cells as questions to put to the vendor, not as answers — the rows marked JS-gated in particular likely have published answers a human can reach in a browser session. Third, remember what a documentation census cannot tell you: whether the documented control governs the actual data flow. That last question is answerable only by testing, and this census deliberately does not claim to have done it for any row. The natural companion piece is the procurement questions this table is built to help you ask — the census supplies the documented baseline per vendor, the checklist turns open cells into contract questions. Teams that want help running this kind of evaluation against their own shortlist and tiers can look at our AI transformation engagements, which start from exactly this documented-versus-verified distinction.
Looking forward, two things seem likely to change fastest. The three rows with no locatable policy page can each be fixed by a vendor shipping a single URL — so those cells may be the shortest-lived findings here, and re-running the census against them is cheap. And the ownership churn around these products — one census vendor changed parent companies three days before this data was retrieved — can move terms without moving URLs, which is why the as-of date travels with every figure rather than sitting in a footnote.
08 — ConclusionThe gaps are the finding. #
Seventeen vendors, six questions, and an honest account of every cell that would not close.
The census’s headline is not a ranking. It is that the questions procurement teams actually ask — how long is my code kept, is it trained on, at which tier, says who — are fully answerable from public documentation for some vendors, partially for others, and not at all for three, on the date checked. Full, clear documentation of all six questions is demonstrably realistic: one specialist vendor answers every question outright, and two more leave only a single sub-point open. It is not an unreasonable standard to hold the rest of the category to.
The equally important half is what this table does not say. An unresolved cell is not an accusation; a documented “no training” is not a verified one; and a vendor with more open cells is not shown to be worse in practice — only less publicly legible on these six questions, through the URLs this pass could reach, on August 17, 2026. Keeping those distinctions visible in the table itself, rather than flattening them into a score, is what makes the dataset citable at all.
Vendor documentation changes without notice, ownership changes move faster than terms pages, and three of these rows could be transformed by a single working URL. This census is a snapshot with a stated method — re-run it, and the differences between snapshots become the story.