Picking an AI coding assistant is not a benchmark problem. The vendors that win a benchmark may still train on your private repo, log every keystroke by default, or hold your code for ninety days after you cancel. The right question is not “which model writes the best code” - it is “which assistant fits my repository, my team, and my threat model.” This guide walks through the five questions that answer that, then shows what four real tools actually publish about their defaults so you can see the difference on paper.
TL;DR
- Training on your code is the first decision, not the third. GitHub Copilot’s policy explicitly says “interaction data…from Copilot Free, Pro, and Pro+ users will be used to train and improve our AI models unless they opt out” from April 24 onward. Cursor’s privacy policy says “We do not use Inputs or Suggestions to train our models…unless” one of three named exceptions applies, one of which is your agreement; its data-use page says that with Privacy Mode turned off, Cursor “may use and store codebase data, prompts, editor actions, code snippets, and other code data and actions to improve our AI features and train our models.” Check the Privacy Mode setting, not just the policy.
- Telemetry default matters more than telemetry policy. Cline’s Terms of Service says “Telemetry is on by default and can be disabled at any time in the extension settings.” Telemetry you must switch off is a different product from telemetry that ships off.
- BYOK (bring your own key) changes the threat model. Cline’s Terms state that “If you install a Cline Extension and bring your own API keys and direct all model calls through infrastructure you control, Cline does not receive or store your input tokens, output tokens, underlying code, or other User Content.” The same extension in BYOK mode and in hosted-key mode are two different products.
- Permissions are not a sidebar. Claude Code’s security docs describe a permission-based architecture where bash, file writes, and network calls all prompt by default, plus a sandbox option for filesystem and network isolation. That is the most relevant feature for safe work in an existing repository.
- Verify before you commit. Read the actual document, not the marketing page. A 2026 cross-vendor census of agent data terms found that training defaults “are tier-shaped almost everywhere” and that “A one-word answer per vendor would be wrong.”
The five questions to ask before you install
The right way to evaluate an AI coding assistant is to answer five questions in order. Skip one and the answer to the others may not matter.
1. Does it train on my code by default?
The single biggest fork. GitHub Copilot’s policy update is explicit: “From April 24 onward, interaction data (specifically inputs, outputs, code snippets, and associated context) from Copilot Free, Pro, and Pro+ users will be used to train and improve our AI models unless they opt out.” (GitHub’s dashes replaced by parentheses.) That is on-by-default with a toggle. GitHub says Copilot Business and Copilot Enterprise users are not affected, and interaction data from users who opt out is excluded. So your decision is not “does Copilot train on me” - it is “which Copilot plan am I on.”
Cursor’s privacy policy takes the opposite starting point: “We do not use Inputs or Suggestions to train our models, or permit third parties to use them for training, unless: (1) they are flagged for security review…, (2) you explicitly report them to us…, or (3) you’ve explicitly agreed to their use for such training purposes.” The third exception carries the weight: Cursor’s data-use page says that if you turn off “Privacy Mode”, Cursor may use your code data “to improve our AI features and train our models.” The 2026 census reports that Privacy Mode is on by default only for Enterprise, so on other plans training is effectively on until you enable it.
Cognition, which now operates Windsurf, publishes a tiered model on its Devin security page: “By default, we may use your data for model training purposes” but “If you’re on a paid plan, you can opt out at any time on the Data Controls settings page” and “If you are an Enterprise customer, we will never train on your data without your express prior written consent.” The census records the same tiering for Windsurf.
The right answer for a personal project, a commercial codebase, and a regulated workload is rarely the same. Pick the vendor whose default matches the strictest answer.
2. Is telemetry on by default, and can I verify it actually turns off?
A toggle that ships off-by-default is not the same as a toggle you have to flip. Cline’s terms state telemetry “is on by default” and “can be disabled at any time in the extension settings, after which no telemetry data will be transmitted to or retained by Cline.” But in October 2025 a user reported in issue #7068 that, with telemetry disabled, Fiddler still showed data being sent to data.cline.bot; the issue was closed as not planned. The lesson: when telemetry default is on, verify the disable with a network capture before relying on it for sensitive work.
Claude Code’s documentation addresses a different layer: in Manual mode it “starts with read-only permissions” and asks before editing files or running commands that can modify your system, while a built-in set of read-only commands runs without asking. Those prompts govern actions on your machine; they do not stop your code from being sent to the model, so training and retention still depend on your plan and settings.
3. What permissions does it ask for, and can I scope them?
This is the part most evaluation guides skip. Claude Code describes its permission architecture in detail: read-only permissions in manual mode, an optional auto-mode classifier that “reviews actions instead of you and blocks the ones it judges unsafe,” and a sandboxed bash tool that provides “filesystem and network isolation.” The permission rules are per-command and per-path, and the system supports allowlisting for “frequently used safe commands per-user, per-codebase, or per-organization.”
Cursor asks for repository and filesystem access to index your code; Cline asks for VS Code permissions to read and write in your workspace plus the terminal. The question to ask is not “what does it need to function” but “what is the narrowest scope it can run in for the work I have today.” A tool that lets you grant a per-directory permission is a different tool from one that wants your whole home directory.
4. How long does my code sit on their servers?
The Digital Applied 2026 census breaks down retention per agent: Anthropic’s consumer tier is “5 years with the training toggle on, 30 days off,” and commercial is “30 days standard.” Cursor’s privacy policy says data is retained “only for as long as necessary to operate the Service” without a day count. Cognition/Devin says they retain “for the duration of the relationship with a given Customer, unless otherwise specified.” A vague “as long as necessary” answer is itself a signal: the vendor has not committed to a deletion window you can audit.
If the retention number is not on the policy page, do not assume it is short. Ask the vendor, in writing, before you point the assistant at a repository you cannot afford to lose.
5. Can I run it with my own model, my own keys, or my own infra?
BYOK (bring your own key) changes the threat model completely. Cline’s Terms state that with your own keys routed through infrastructure you control, “Cline does not receive or store your input tokens, output tokens, underlying code, or other User Content.” The 2026 census confirms that BYOK mode means “we do not collect it” for that vendor. Claude Code supports the same pattern through the Anthropic API or a third-party provider. Cursor accepts your own API key, but its data-use page warns that “Even if you use your API key, your requests will still go through our backend!”
If your threat model includes “no third party should retain a copy of my code,” the question is not which vendor is best, it is which vendor lets you wire up your own keys. The honest answer narrows the field fast.
A worked comparison
| Question | GitHub Copilot (Pro) | Cursor (Pro) | Claude Code (Pro) | Cline (BYOK) |
|---|---|---|---|---|
| Train on your code by default? | Yes, opt-out | Yes unless Privacy Mode is on (on by default only for Enterprise, per the census) | Consumer plans: user setting; commercial: no, opt-in only via the Development Partner Program | No (Cline itself does not retain in BYOK) |
| Telemetry default | Not stated in the cited post | Not stated (the census notes no telemetry statement) | Not covered here; Manual mode prompts before edits and system-modifying commands | Telemetry on by default, disable in settings |
| Permissions | Editor + repo scope | Repo + filesystem index | Per-command, per-path, optional sandbox | VS Code workspace + terminal |
| Retention | No day count in the cited post | ”Only for as long as necessary to operate the Service” | 30 days standard for commercial; 5 years consumer if training toggle on | Not retained in BYOK |
| Code leaves your machine? | Yes, sent to model API | Yes, via Cursor’s backend even with your own key | Yes, sent to Anthropic API | Yes, to the model provider you choose; not to Cline in BYOK |
The table is built from each vendor’s own documents. It is also incomplete: each row hides plan-tier carve-outs that change the answer. Read the linked sources for the version that matches your plan.
How to verify before you commit
A five-step audit that takes one afternoon:
- Open the privacy policy and search for “train.” Count the carve-outs. Three is normal; eight is a red flag.
- Open the terms of service and search for “telemetry” and “default.” Off-by-default is the answer you want.
- Open the security documentation and look for a permissions model. If there is no permissions doc, the answer to question 3 is “whatever it wants.”
- Install the extension in a throwaway repo and run a packet capture. Confirm that disabling telemetry actually stops traffic.
- Read the data-retention page for a number, not “as long as necessary.” If the vendor cannot commit to a day count, ask why.
The Bottom Line
An AI coding assistant is a repository-scoped data relationship. The five questions - training default, telemetry default, permission scope, retention window, BYOK support - predict almost everything that will go wrong. The right vendor for a hobby project is rarely the right vendor for a closed-source commercial repo, and the right vendor for either is rarely the right vendor for a regulated workload with audit obligations. Read the actual documents (linked below), pick the vendor whose defaults match the strictest workload you have, and verify with a packet capture before you trust the toggle.