Short answer: For individual GitHub Copilot plans (Free, Pro, Pro+ and, in current docs, Max), GitHub’s official blog and changelog say that from 24 April 2026 it may use Copilot interaction data — prompts, suggestions, code snippets and associated context — to train and improve AI models, unless you opt out. Copilot Business and Copilot Enterprise customer data is not used for that training, GitHub says. The setting lives in your Copilot privacy options: “Allow GitHub to use my data for AI model training.” Cursor’s official Data Use page, updated 3 September 2026, says that if Privacy Mode is on, Cursor will not train on your customer data and its providers have zero-data-retention agreements; if you turn Privacy Mode off, Cursor may use codebase data, prompts and snippets to train its models. An opt-out does not un-train a model already built. A TimeBind cannot change those settings. It can date a source file or archive you kept yourself.
Last checked 12 November 2026. General information for developers who use GitHub Copilot or Cursor, not legal, privacy or employment advice. Product names, plan names and setting labels can change. Check the official settings pages in your own accounts. TimeBinder does not change GitHub’s or Cursor’s settings, does not detect whether code was used in training, and a dated record is not proof that a file was kept out of a model. GitHub Copilot and Microsoft 365 Copilot are different products.
Table of Contents
What GitHub officially says about Copilot
On 25 March 2026 GitHub published a changelog entry, and a company-news post, about an update to how it uses Copilot interaction data. From 24 April 2026, GitHub says, interaction data from Copilot Free, Pro and Pro+ users will be used to train and improve its AI models unless those users opt out. Current model-hosting documentation also lists Copilot Max among the individual plans. Copilot Business and Copilot Enterprise users are not affected by that update, GitHub says, and it does not use their customer data to train AI models.
What counts as interaction data, on GitHub’s list, includes inputs you send to Copilot, suggestions you accept or change, code snippets shown to the model, comments, file names and repository structure, and feedback such as thumbs up or down. GitHub is explicit that this program does not use content from your issues, discussions, or private repositories at rest. It uses the phrase “at rest” deliberately: Copilot does process code from private repositories when you are actively using Copilot, and that interaction data could be used for model training unless you opt out.
GitHub says the data may be shared with affiliates, including Microsoft, and that it will not be shared with third-party AI model providers for their own independent training. It also says that if you had already opted out of GitHub collecting this data for product improvements, that preference was retained.
This is a current search topic. On 12 November 2026, Google autocomplete completed “opt out github copilot training,” “how to opt out of github copilot ai training,” and “does cursor train on your code.” How-to videos from March and April 2026 (for example SavvyNik, 14,927 views on 3 April 2026) show that developers were already looking for the toggle when the policy took effect. Use GitHub’s own pages for the setting name, not a video.
How to opt out on GitHub
GitHub’s documentation, “Managing GitHub Copilot policies as an individual subscriber,” is the official path. In outline:
- Open github.com/settings/copilot, or Settings from your profile picture, then Copilot.
- Find Allow GitHub to use my data for AI model training in the Privacy section, and set it to Disabled.
- GitHub warns that the change can take up to 30 minutes to take effect, and that restarting your editor applies it immediately.
- If you have more than one personal GitHub account, check each one. If the row is not there at all, your Copilot seat may come from an organisation on a Business or Enterprise licence, where GitHub says training on that customer data is already excluded.
This setting is about Copilot interaction data. It is not a switch for every GitHub feature, and it is not the same as Microsoft 365 Copilot, which is a different product with its own admin and privacy documentation. Autocomplete also suggests questions about Microsoft 365 Copilot; do not assume one toggle covers both.
What Cursor officially says
Cursor publishes a Data Use & Privacy Overview, last updated 3 September 2026. The page describes two states:
- If you enable Privacy Mode in Cursor’s settings: Cursor says customer data will not be used for training by Cursor. It says it maintains zero data retention (ZDR) agreements with its providers, and that AI model providers will not store or train on your data. It also notes exceptions: providers may run risk classifiers, and if prompts trigger abuse detectors the data may be stored for investigation. Models that are not under ZDR are designated as such, or require an admin opt-in.
- If you turn Privacy Mode off: Cursor says it may use and store codebase data, prompts, editor actions, code snippets and other code data to improve AI features and train its models. Some inference providers may temporarily access inputs and outputs to improve performance; Cursor says that data is deleted after use.
Cursor also says that even if you use your own API key, requests still go through its backend, where final prompt building happens, and that file contents may be cached temporarily to reduce latency. It says cached contents are never used as training data when Privacy Mode is enabled. We did not treat a default on or off as a fact we could state from that page; open Cursor’s settings and check the control yourself.
Practical checklist
- Set the GitHub Copilot privacy control on each personal account that uses an individual Copilot plan, then restart the editor.
- Turn on Cursor Privacy Mode if you use Cursor and you do not want Cursor to train on your customer data. Re-check after updates; setting labels move.
- Read the plan you are actually on. Business and Enterprise Copilot seats are described differently from Free, Pro, Pro+ and Max. An employer-provided seat is not the same as a personal subscription.
- Do not confuse “private repo at rest” with “nothing leaves your machine.” GitHub’s own wording is that interaction data created while you use Copilot in a private repository can be in scope unless you opt out.
- Keep dated copies of the code that matters, in a place you control: a release archive, a tagged export, or the specific files you may later need to show. A TimeBind records that an exact file existed by a date and still matches. It does not show what a model trained on, and it does not replace git history, code review or a licence file. For the hashing step itself, the free SHA-256 file hash checker and bulk SHA-256 manifest tool run in your browser.
A separate guide, already planned on this site, will cover records of what you wrote and what you reviewed when AI assists with code. This page is only about training toggles and the files you keep.
What a TimeBind does and does not show
A TimeBind is a dated, checkable record that an exact file existed no later than a recorded time and still matches. The SHA-256 fingerprint is made in your browser and the file is never uploaded. The record is anchored to Bitcoin (a Merkle root in an OP_RETURN). Your first Pooled TimeBind is free; after that, TimeBinds start from US$5, and an ASAP TimeBind is US$15. See how it works.
For a developer, a useful TimeBind is often a zip of a release, a particular source file, or a design document you are about to paste into a prompt. You can later show that this exact file existed no later than the recorded time and still matches. That can matter if a later dispute is about whether a file existed by a date, not about what a model contains.
A TimeBind does not opt you out of Copilot or Cursor, does not show whether a snippet entered a training set, does not prove authorship, and does not replace Git commit history.
Limits
Vendor policies change. The April 2026 GitHub policy and the September 2026 Cursor page are what we read on 12 November 2026. An opt-out stops future use on the terms the vendor states; it does not un-train a model, bind a third-party tool you paste code into, or cover Microsoft 365 Copilot, Claude in a browser, or a plugin you have not checked. If your employer has a policy on AI tools, that policy sits beside these toggles.
Tools that can help
Official starting points: GitHub’s Copilot policy docs and Cursor’s Data Use page. On this site, the free SHA-256 file hash checker and bulk SHA-256 folder manifest help you fingerprint files before you date them, and the source-code timestamping hub walks through keeping a dated record of code. See also how to prove source code existed before a date.
Before the next session with a cloud coding assistant, the free cloud coding assistant checklist helps you review the plan you are on, the current terms, and the exact files to keep. It cannot decide a licence, and it cannot show what a vendor did with your code.
A different, narrower job is merging a GitHub Actions workflow that calls third-party actions, rather than sharing a repo with a cloud assistant. The free GitHub Actions workflow lockfile checklist looks at the current lockfile docs and the exact copies to keep. Locking does not show that an action is safe.
Frequently Asked Questions
-
If I pay for Copilot Pro, does GitHub still use my interaction data for training?
A paid individual plan does not, on the official pages we read, replace the privacy control. GitHub says the April 2026 update applies to Copilot Free, Pro and Pro+ (and current docs also mention Max). You still opt out in settings. Business and Enterprise are described as already excluded.
-
If I opt out now, is my earlier Copilot chat removed from models already trained?
Not on the sources we read. GitHub describes the opt-out as stopping collection from that point forward. We did not see a description of un-training a model already built.
-
Does Privacy Mode in Cursor mean my code never leaves my machine?
No. Cursor says that even with your own API key, requests still go through its backend for prompt building, and file contents may be cached temporarily. With Privacy Mode on, Cursor says that customer data is not used for training and cached contents are not used as training data. That is not the same as a fully local, offline tool.
-
Does a TimeBind show that my repo was not used to train a model?
No. A TimeBind only records that an exact file you TimeBind existed by a date and still matches. It cannot show what was, or was not, in a training set.
Sources checked
- GitHub Blog, “Updates to GitHub Copilot interaction data usage policy,” https://github.blog/news-insights/company-news/updates-to-github-copilot-interaction-data-usage-policy/ (read 12 November 2026)
- GitHub Changelog, “Updates to our Privacy Statement and Terms of Service: How we use your data,” 25 March 2026, https://github.blog/changelog/2026-03-25-updates-to-our-privacy-statement-and-terms-of-service-how-we-use-your-data/
- GitHub Docs, “Managing GitHub Copilot policies as an individual subscriber,” https://docs.github.com/en/copilot/how-tos/manage-your-account/manage-policies (read 12 November 2026)
- GitHub Docs, “Hosting of models for GitHub Copilot,” https://docs.github.com/en/copilot/reference/ai-models/model-hosting (read 12 November 2026)
- Cursor, “Data Use & Privacy Overview,” last updated 3 September 2026, https://cursor.com/data-use (read 12 November 2026)
Date the source files you keep yourself
Your first Pooled TimeBind is free, with no credit card required. After that, TimeBinds start from US$5, and an ASAP TimeBind is US$15. Click here to start, or see plans and pricing.
Related: Asahi Linux moves from MIT to GPL: what developers should keep; An AI agent deleted a professor’s files: what to do before you give access.
Related: EtherSphere bee-js npm compromise: what developers should keep.
Related: GitHub Actions CI secret stealer: what developers should keep.
