Data Privacy and AI Tools: What Actually Leaves Your Machine

Your code, your prompts, sometimes your secrets - all of it can leave your machine when you use an AI tool. Knowing what goes where, and how to opt out, matters.

What actually gets sent

Every time you use an AI coding tool, whatever you type, and often whatever it reads for you, like open files or command output, gets sent to the AI vendor's servers to generate a response. That can include source code, error messages, file paths, and, if you're not careful, secrets like API keys sitting in a file the agent read.

Training vs. not training on your data

Whether your content trains future models depends on the product and your settings. Anthropic's consumer product, Claude.ai, only uses your conversations for training if you opt in via account settings, or if a conversation is flagged for a safety review. Commercial and API usage differs: Anthropic's commercial terms state customer content from the API and business services is not used to train models.

The GDPR angle, briefly

If you or your users are in the EU, the GDPR sets rules for personal data - a lawful basis for processing it, data minimization, and rights like access and erasure. If prompts sent to an AI tool contain personal data, that falls under the same rules as any other data processing.

Simple team rules that help

Never paste secrets into a prompt, even to a trusted tool - treat prompts as if logged. Check your AI tool's data-usage settings once, as a team, and write the decision down. For sensitive work, prefer commercial or API terms over consumer settings, since the default differs.

EXAMPLE

A one-line team rule to write down: no customer data or credentials in prompts, ever - use synthetic test data. Check the training setting in every consumer AI account rather than assuming a default - vendors differ, and Anthropic's consumer plans only use chats for model improvement if you switch it on. API and Enterprise usage does not train on customer content by default.

🛠️ EXERCISE — TRY IT YOURSELF

Check the actual data-usage settings for an AI tool you use.

Open the account or privacy settings of an AI tool you use regularly.
Find the setting that controls whether your conversations are used for training.
Note whether it's currently on or off, and whether that matches what you assumed.
Write one sentence describing what you'd never want to appear in a prompt to that tool.

✅ SELF-CHECK

☐ Did you find out whether your chats are used for model training?
☐ Do you know whether you're using a consumer or a commercial account?
☐ Did you write a short team rule about which data must never go in a prompt?

QUICK QUIZ

By default, does Anthropic's consumer product Claude.ai use your conversations to train future models?