Windsurf (formerly Codeium) — privacy & data policy

Provider: Cognition AI (formerly Exafunction). PromptPrivacy score: 35/100. Last verified November 01, 2026.

What happens to your data?

Cognition AI processes your account details, usage logs, and user content (inputs, file uploads, and outputs) to deliver and operate its services. User content may be utilized to train and improve the AI models powering the platform depending on your service terms. Data is shared with third-party service providers, corporate affiliates, and advertising partners where applicable.

Does it train on your data?

Trains on your content by default, depending on terms. The policy indicates that User Content—including inputs, uploads, feedback, and outputs—may be used to train, fine-tune, and improve AI models under the company's legitimate interests unless otherwise specified in separate terms.

Can you opt out?

Not specified. The policy states that model training depends on applicable terms but does not detail an explicit mechanism or setting to opt out of training on user content.

Data retention

Data is retained for as long as necessary to provide services, meet legal obligations, or protect platform security. Audio recordings from voice features are deleted immediately after transcription, and other personal data is deleted when no longer required or upon user request.

Encryption & security

Not specified beyond general commercially reasonable technical, administrative, and organizational security measures. Specific encryption protocols like TLS or encryption at rest are not mentioned.

Is it safe for work?

Caution is advised for proprietary or sensitive workplace code under individual accounts because user content may be used for model training. Business use should be conducted under a negotiated enterprise agreement, which supersedes the general privacy policy.

Source policy: https://windsurf.ai/privacy-policy