Where your data lives and what the models are trained on is a question people put off until an incident. An agentic IDE sees a lot: the source code, your prompts, the agent's own output and the feedback you leave on its answers. It is natural to ask what of this goes outside and what the models learn from, and the answer does not reduce to one checkbox - it differs across plans and for ACP agents. And the cost of a mistake here is not lost time but data you can no longer recall.
The naive view is that since this is a paid tool, data is private by default and not trained on. Or the opposite: that nothing can be done and it all leaves anyway. Both simplifications hide the real levers you have, and both lead to a decision made without looking.
Per the current security documentation, Cognition may by default use self-serve data for model training - it is part of the price of inexpensive access. But a paid plan gives an opt-out in Data Controls; after opting out, data is not used for training and Zero Data Retention is enabled with the model providers. On Teams this is done by an administrator - a personal checkbox does not help if the decision is made at the team level, and conversely a team opt-out covers everyone at once.
It matters that training and retention are different axes. An opt-out removes your data from training; Zero Data Retention means the model provider does not hold the request longer than needed to answer. One is about whether the code enters the weights of a future model; the other about whether it stays on the provider's servers after the answer is returned. Confusing them means closing one channel and missing the second. In practice that is two checks, not one: the training status and the retention status are read separately, because closing one says nothing about the other.
For enterprise, Cognition states that it never trains on customer data without express prior written consent, and the organization's contract takes priority over the general terms. Separately, it is worth checking the retention of feedback and interaction data: training and retention are different questions, and answering the first does not close the second. The enterprise contour changes the owner of the decision but does not remove the need to read what was actually signed.
The professional mechanism is to treat privacy as a configuration with a date and an owner, not as a brand promise. Each fact has a source - the security or privacy page; a value - default, opt-out or ZDR; and an owner of the decision - you on a paid plan, the admin on Teams, the contract on enterprise. Until these three are named, talk of privacy stays a guess rather than a position.
The most important boundary here is that ACP is a separate contract. Devin's opt-out does not automatically extend to an external ACP agent: it follows its own provider's privacy, telemetry and settings, and those must be checked independently. A shared protocol does not mean a shared data policy, and that distinction is worth holding firmly - otherwise code leaves the edge of your contract where you did not expect it.
The cost of the wrong model is irreversible in a way a code mistake is not. Data that went into training cannot be recalled; code carried by a third-party agent past the edge of your contract is already past it; feedback settling in retention you did not know about keeps being stored. A diff can be rolled back, a trained model cannot, and so the cost of a miss here is higher than an ordinary engineering error. That is exactly why privacy is decided at the entrance, before the first send, not sorted out after the fact when the data is already gone.
When an opt-out is justified follows from the sensitivity of the data and the plan. On a paid plan with sensitive code it is justified almost always. On Teams the decision rises to the admin and applies to the whole team at once. On enterprise it is fixed by contract and audit, not by a personal setting. For ACP the rule is one: read the provider before connecting, not after the first request.
Verify all this not from memory but from the live pages. Open Data Controls and confirm the opt-out status. On Teams confirm the admin applied it for the whole team. For enterprise check the contract on consent and retention. For each ACP agent open its privacy and telemetry setting separately. Each check is a fact on the screen, not a recollection of how it was set once.
The typical failure is treating a personal opt-out as enough on Teams; confusing training with retention; assuming Devin's policy covers an ACP agent; checking privacy against the book rather than the current page. The sign is the same: data is discussed in general, without naming the plan, the decision owner and the specific page. Name them - and the picture stops being a guess and becomes verifiable.