Picking an AI coding assistant is not a benchmark problem. The vendors that win a benchmark may still train on your private repo, log every keystroke by default, or hold your code for ninety days after you cancel. The right question is not “which model writes the best code” - it is “which assistant fits my repository, my team, and my threat model.” This guide walks through the five questions that answer that, then shows what four real tools actually publish about their defaults so you can see the difference on paper.
TL;DR
- Training on your code is the first decision, not the third. GitHub Copilot’s policy explicitly says “interaction data…from Copilot Free, Pro, and Pro+ users will be used to train and improve our AI models unless they opt out” from April 24 onward. Cursor’s privacy policy says “we do not use Inputs or Suggestions to train our models…unless” three named exceptions apply. Same vendor family, opposite defaults.
- Telemetry default matters more than telemetry policy. Cline’s Terms of Service says “Telemetry is on by default and can be disabled at any time in the extension settings.” Claude Code’s documentation describes manual mode where every non-read-only Bash command asks for approval. Off-by-default is a different product from toggle-and-default-on.
- BYOK (bring your own key) changes the threat model. Cline’s Terms state that “If you install a Cline Extension and bring your own API keys and direct all model calls through infrastructure you control, Cline does not receive or store your input tokens, output tokens, underlying code, or other User Content.” The same extension in BYOK mode and in hosted-key mode are two different products.
- Permissions are not a sidebar. Claude Code’s security docs describe a permission-based architecture where bash, file writes, and network calls all prompt by default, plus a sandbox option for filesystem and network isolation. That is the most relevant feature for safe work in an existing repository.
- Verify before you commit. Read the actual document, not the marketing page. A 2026 cross-vendor census of agent data terms found that “the answer to ‘does this agent train on my code?’ is almost never a single word - it depends on the plan tier.”
The five questions to ask before you install
The right way to evaluate an AI coding assistant is to answer five questions in order. Skip one and the answer to the others may not matter.
1. Does it train on my code by default?
The single biggest fork. GitHub Copilot’s policy update is explicit: “From April 24 onward, interaction data - specifically inputs, outputs, code snippets, and associated context - from Copilot Free, Pro, and Pro+ users will be used to train and improve our AI models unless they opt out.” That is on-by-default with a toggle. Copilot Business and Enterprise are excluded from the program, and “Interaction data from users who opt out” is also excluded. So your decision is not “does Copilot train on me” - it is “which Copilot plan am I on.”
Cursor’s privacy policy takes the opposite starting point: “We do not use Inputs or Suggestions to train our models, or permit third parties to use them for training, unless: (1) they are flagged for security review…, (2) you explicitly report them to us…, or (3) you’ve explicitly agreed to their use for such training purposes.” Off by default with three named exceptions.
Windsurf (now operated by Cognition/Devin) publishes a tiered model: “By default, we may use your data for model training purposes” but “If you’re on a paid plan, you can opt out at any time on the Data Controls settings page” and “If you are an Enterprise customer, we will never train on your data without your express prior written consent.”
The right answer for a personal project, a commercial codebase, and a regulated workload is rarely the same. Pick the vendor whose default matches the strictest answer.
2. Is telemetry on by default, and can I verify it actually turns off?
A toggle that ships off-by-default is not the same as a toggle you have to flip. Cline’s terms state telemetry “is on by default” and “can be disabled at any time in the extension settings, after which no telemetry data will be transmitted to or retained by Cline.” But a 2025 issue (cline/cline #7068) showed that telemetry was still being sent to data.cline.bot after users disabled it, verified with Fiddler. The lesson: when telemetry default is on, verify the disable with a network capture before relying on it for sensitive work.
Claude Code’s documentation takes the opposite stance at the tool layer: in manual mode, “every non-read-only command asks for approval” and only a fixed set of read-only commands runs without prompting. There is no general “training telemetry” switch because the default is to ask before sending anything.
3. What permissions does it ask for, and can I scope them?
This is the part most evaluation guides skip. Claude Code describes its permission architecture in detail: read-only permissions in manual mode, an optional auto-mode classifier that “reviews actions instead of you and blocks the ones it judges unsafe,” and a sandboxed bash tool that provides “filesystem and network isolation.” The permission rules are per-command and per-path, and the system supports allowlisting for “frequently used safe commands per-user, per-codebase, or per-organization.”
Cursor asks for repository and filesystem access to index your code; Cline asks for VS Code permissions to read and write in your workspace plus the terminal. The question to ask is not “what does it need to function” but “what is the narrowest scope it can run in for the work I have today.” A tool that lets you grant a per-directory permission is a different tool from one that wants your whole home directory.
4. How long does my code sit on their servers?
The Digital Applied 2026 census breaks down retention per agent: Anthropic’s consumer tier is “5 years with the training toggle on, 30 days off,” and commercial is “30 days standard.” Cursor’s privacy policy says data is retained “only for as long as necessary to operate the Service” without a day count. Cognition/Devin says they retain “for the duration of the relationship with a given Customer, unless otherwise specified.” A vague “as long as necessary” answer is itself a signal: the vendor has not committed to a deletion window you can audit.
If the retention number is not on the policy page, do not assume it is short. Ask the vendor, in writing, before you point the assistant at a repository you cannot afford to lose.
5. Can I run it with my own model, my own keys, or my own infra?
BYOK (bring your own key) changes the threat model completely. Cline’s Terms state that with your own keys routed through infrastructure you control, “Cline does not receive or store your input tokens, output tokens, underlying code, or other User Content.” The 2026 census confirms that BYOK mode means “we do not collect it” for that vendor. Claude Code supports the same pattern through the Anthropic API or a third-party provider. Cursor is a hosted product without an equivalent BYOK path.
If your threat model includes “no third party should retain a copy of my code,” the question is not which vendor is best, it is which vendor lets you wire up your own keys. The honest answer narrows the field fast.
A worked comparison
| Question | GitHub Copilot (Pro) | Cursor (Pro) | Claude Code (Pro) | Cline (BYOK) |
|---|---|---|---|---|
| Train on your code by default? | Yes, opt-out | No, three named exceptions | No for commercial API; consumer opt-in via Development Partner Program | No (Cline itself does not retain in BYOK) |
| Telemetry default | Opt-out settings toggle | Privacy Mode off by default for Free/Pro, on for Enterprise | Manual mode prompts for every non-read-only action | Telemetry on by default, disable in settings |
| Permissions | Editor + repo scope | Repo + filesystem index | Per-command, per-path, optional sandbox | VS Code workspace + terminal |
| Retention | Policy applies “for product improvements” until opt-out | ”Only for as long as necessary to operate the Service” | 30 days standard for commercial; 5 years consumer if training toggle on | Not retained in BYOK |
| Code leaves your machine? | Yes, sent to model API | Yes, sent to model API | Yes, sent to Anthropic API | Configurable; no in BYOK |
The table is built from each vendor’s own documents. It is also incomplete: each row hides plan-tier carve-outs that change the answer. Read the linked sources for the version that matches your plan.
How to verify before you commit
A five-step audit that takes one afternoon:
- Open the privacy policy and search for “train.” Count the carve-outs. Three is normal; eight is a red flag.
- Open the terms of service and search for “telemetry” and “default.” Off-by-default is the answer you want.
- Open the security documentation and look for a permissions model. If there is no permissions doc, the answer to question 3 is “whatever it wants.”
- Install the extension in a throwaway repo and run a packet capture. Confirm that disabling telemetry actually stops traffic.
- Read the data-retention page for a number, not “as long as necessary.” If the vendor cannot commit to a day count, ask why.
The Bottom Line
An AI coding assistant is a repository-scoped data relationship. The five questions - training default, telemetry default, permission scope, retention window, BYOK support - predict almost everything that will go wrong. The right vendor for a hobby project is rarely the right vendor for a closed-source commercial repo, and the right vendor for either is rarely the right vendor for a regulated workload with audit obligations. Read the actual documents (linked below), pick the vendor whose defaults match the strictest workload you have, and verify with a packet capture before you trust the toggle.