Does Claude Code send my code to Anthropic?

Yes. Claude Code runs on your machine, but it is a client for a model that does not. Anthropic's own documentation is direct about it: Claude Code "sends data over the network. This data includes all user prompts and model outputs, encrypted in transit via TLS 1.2+."

That is the easy half of the answer. The half that decides whether you can use it on a client's repository is narrower: which parts of your machine reach the API, how long they are kept, whether they train a model, and which of those you can turn off. Below is what the data usage documentation states as of August 2026, followed by what you can do about it. If you want the version of this argument that applies to pasted text rather than agent traffic, we measured how much slips past a detector on 1,800 labelled spans.

What actually leaves

Not "your repository". Claude Code does not upload a project. It sends what the model needs to answer, one turn at a time:

• Your prompts. Every word you type.
• The contents of every file the agent reads. A tool result is just more text in the request. If the agent opens a fixture with real customer names in it, those names are in the request.
• Command output. git log, a failing test, cat customers.csv. Same path.
• Web fetches. Whatever the page returned.

The practical consequence is that the boundary is not "files I chose to share". It is "files the agent decided it needed", and you find out which ones after the fact.

Two things are stated as not leaving. Usage metrics "never include your code, prompts, or file paths". Error reports carry stack traces from Claude Code's internals, with known patterns of secrets, file paths, email addresses and other personal information redacted before anything is sent. Both have switches: DISABLE_TELEMETRY=1 and DISABLE_ERROR_REPORTING=1.

Training and retention, by plan

This is where the answer splits, and where most of the confusion lives.

Free, Pro and Max. Anthropic trains new models on data from these accounts when the setting is on, and that explicitly includes Claude Code used from them. Retention follows the same switch: five years if you allow training, thirty days if you do not. The control is at claude.ai/settings/data-privacy-controls.

Team, Enterprise, API and third-party platforms. Anthropic does not train generative models on code or prompts sent under commercial terms unless the customer opts in, for example through the Development Partner Program. Standard retention is thirty days. Zero data retention exists for Claude Code on Claude for Enterprise, but it is not part of the standard Enterprise plan: it is enabled per organisation after an eligibility check.

So a developer on a personal Max subscription and a developer on their employer's Enterprise account are running the same binary under materially different terms. The plan is the policy.

The three paths that send code you did not mean to send

All three are opt-in. All three are easy to trigger without thinking about it.

/feedback, /bug and /share. These submit a copy of your conversation history, including code, and they are retained for five years. You choose how much history goes: the current session by default, or other sessions from the same project over the last 24 hours or 7 days. DISABLE_FEEDBACK_COMMAND=1 removes the command.

The session quality survey follow-up. The star rating itself records nothing but the rating. The question after it, asking whether Anthropic can look at your session transcript, is a different thing: answering yes uploads the conversation, subagent transcripts and the raw session log from disk. Known API key and token patterns are redacted first. Source code and file contents are uploaded as they are. Retained up to six months. CLAUDE_CODE_DISABLE_FEEDBACK_SURVEY=1 stops being asked.

Cloud sessions. Claude Code on the web clones your repository into an Anthropic-managed VM by default. Retention and usage follow your account type, which returns you to the table above.

CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC covers the whole non-essential group at once. One thing it does not cover: before fetching a URL, the WebFetch tool sends the hostname to api.anthropic.com to check it against a blocklist. Hostname only, no path and no page contents, and it runs whichever provider you use.

The copy on your own disk

Worth knowing because it has nothing to do with Anthropic. Claude Code writes session transcripts to ~/.claude/projects/ in plaintext and keeps them for thirty days by default, so you can resume a session. Adjust it with cleanupPeriodDays.

If a client's name went into a prompt three weeks ago, it is sitting on your laptop in a readable file right now. Backups pick it up. So does anyone with your unlocked machine. For a lot of people this is the larger exposure, and it is entirely yours to fix.

When this is fine, and when it is not

For most work it is fine, and saying otherwise would be dishonest. Thirty-day retention under commercial terms with no training is an ordinary processor arrangement, and it is the same shape as the CI system and the error tracker you already trust with the same code.

It stops being fine at a specific boundary: when the data in the repository is not yours to place with a processor of your choosing. Client records in a fixture. Patient identifiers in a seed script. Employee data in a migration. Then the question is not whether Anthropic is trustworthy. It is whether your contract with the person that data belongs to permits a subprocessor you did not name, and a retention window you did not negotiate. No vendor setting answers that for you.

The second boundary is deletion. Retention policies describe what a company intends to keep. They do not describe what a court can later require it to produce. That is not a hypothetical about AI vendors any more, and it is the reason "we do not train on it" and "nobody will ever read it" are different sentences.

Sending less

In rough order of how much they cost you:

1. Set DISABLE_TELEMETRY=1, DISABLE_ERROR_REPORTING=1 and DISABLE_FEEDBACK_COMMAND=1, or CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC for the group. Free, no change to how you work.
2. Turn the training setting off if you are on a consumer plan. Also drops retention from five years to thirty days.
3. Lower cleanupPeriodDays so the plaintext transcripts on your disk expire sooner.
4. Move to commercial terms, and ask your account team about zero data retention if you qualify.
5. Keep regulated data out of the repository. Correct, and rarely available: the fixture with real names in it usually exists because someone needed it to be realistic.
6. Mask at the read boundary, so the agent works on tokens instead of values.

What we do about the last one

That last item is what Velum is. The desktop app ships a set of Claude Code hooks and an MCP server. When the agent reads a file, the hook masks it before the model sees it: names, emails, national IDs, IBANs, cards and credentials become tokens like ⟦PERSON_1⟧. When the agent writes back, the real values go in first, so the file on disk keeps its actual contents. The model never held the values, so what reaches the API does not contain them. Detection runs on your machine and no file content is uploaded to anyone, us included.

The limits, stated plainly, because a privacy tool that oversells is worse than none:

A prompt you type yourself is not protected. If you type a client's name into the prompt, it reaches the model provider before any tool call happens. True of every MCP server, ours included. There is an optional guard that catches it and puts a masked copy on your clipboard, and it is off by default, because it is the only part that interrupts you.

Outside Claude Code, masking is a tool the assistant chooses to call. Other MCP clients get the same local engine, but they expose no interception point, so it is not unconditional there.

Filenames are not masked, only contents. A path is something the agent has to be able to use again.

If masking fails, the content is withheld rather than passed through. A mask that quietly falls back to sending the real thing is worse than no mask, because you would believe you were covered.

Get Velum for macOS

Seven-day trial, no key and no account. The Claude Code hooks are in Settings, AI coding tools.