Windsurf (formerly Codeium) — privacy & data policy

Provider: Cognition AI (formerly Exafunction). PromptPrivacy score: 45/100. Last verified August 26, 2026.

What happens to your data?

Cognition AI collects account details, usage logs, and user content (inputs, code, and file uploads) to operate and customize the service. Depending on your account terms, user content may be used to train and improve AI models. Data is shared with service providers, corporate affiliates, or enterprise account administrators, but is not sold for targeted advertising.

Does it train on your data?

Cognition AI may use User Content (including inputs, file uploads, feedback, and outputs) to train, fine-tune, and improve the AI models powering the services, depending on the terms governing your specific account.

Can you opt out?

Users may object to or restrict processing based on legitimate interests by emailing privacy@cognition.ai, though the availability of these rights depends on jurisdiction or company discretion.

Data retention

Personal information is retained as long as necessary to provide the services, fulfill legal obligations, and protect security. Data is deleted when no longer needed or upon a deletion request. Voice audio is deleted after transcription unless stated otherwise.

Encryption & security

The policy mentions implementing commercially reasonable technical, administrative, and organizational safeguards, but does not detail specific encryption standards (such as TLS or AES) or security certifications.

Is it safe for work?

Caution is advised for sensitive code and data because user content may be used to train models depending on applicable terms. Organizations should verify enterprise-specific terms that restrict model training and review admin visibility settings before business deployment.

Source policy: https://windsurf.ai/privacy-policy