Claude Code Privacy Review for Solo Freelancers

Short answer: Claude Code on a Pro or Max plan can use your coding sessions to train Anthropic’s models if the model-improvement setting is on, and even with it off, any transcript you send as feedback is kept for five years and can still be trained on. Our verdict is USE WITH CAUTION for client work. Policy reviewed September 2026. This matters because Claude Code is not a chat box. It reads your repository, runs commands in your terminal, and opens whatever files a task needs, including a client’s source code, .env files, and internal docs. For a solo developer, the risk isn’t one dramatic leak. It’s a quiet chain of defaults: a feedback click, a safety flag, a plaintext transcript left on your laptop. Each is manageable once you know it exists. Here’s how we vet privacy claims before we give any tool a verdict.

What Claude Code does with your data

Privacy dimension	Claude Code’s answer (sourced)
Trains on your data?	Consumer plans: only if model improvement is on
Training opt-out	Yes, but feedback and safety-flagged sessions are exceptions
Data retention	30 days opted out; 5 years opted in
Feedback transcripts	Kept 5 years via /feedback, /bug, /share
Third-party sharing	Service providers; metrics and error logs to third parties
Storage region	United States and other non-EEA countries
Local copies	Plaintext transcripts in ~/.claude/projects for 30 days
Enterprise-team tier	Team, Enterprise, API: no training, optional zero retention

Claude Code runs on your machine, but the thinking happens on Anthropic’s servers. Every prompt, every file the agent reads to answer it, and every output travels over TLS to the model (per Anthropic’s Claude Code data usage documentation, retrieved 2026-09-25). What happens next depends on which contract you are under. If you sign in with a consumer Free, Pro, or Max account, you fall under the consumer terms: Anthropic trains future models on your sessions when the model-improvement setting is switched on, and that covers Claude Code sessions run from those accounts. If you use Team, Enterprise, or an API key, commercial terms apply and your code and prompts are not used for training unless you join a program such as the Development Partner Program.

The opt-out is real, but it has two carve-outs that freelancers tend to miss. First, sessions flagged for safety review can still be used to improve Anthropic’s detection systems, including training models for its Safeguards team. Second, anything you submit as feedback is kept for up to five years and can feed model training regardless of your setting (per Anthropic’s consumer terms and Privacy Center, retrieved 2026-09-25). In Claude Code, feedback means the /feedback, /bug, and /share commands, which send a copy of the conversation, including code, to Anthropic.

Retention follows your setting: 30 days if you have opted out of model improvement, five years if you have opted in. Commercial accounts get 30 days by default, and zero data retention is available only to eligible Enterprise organizations. On storage, the privacy policy states that personal data goes to servers in the US and other countries outside the EEA, relying on adequacy decisions and standard contractual clauses (per Anthropic’s privacy policy, retrieved 2026-09-25). Operational telemetry (latency and usage metrics, plus crash reports) also goes to third-party logging and error-tracking services. Anthropic says metrics exclude code, prompts, and file paths. There is also a human in the loop: Anthropic confirmed to 404 Media in September 2026 that it uses human review to improve its models.

What this means for solo freelancers

Most client contracts you sign as a freelance developer or data consultant include a confidentiality clause, and many include a data processing addendum. Claude Code’s consumer defaults don’t break those promises by themselves. The trouble comes from small actions that move client material into a longer-lived pipeline. Three scenarios show where it can go wrong.

• If you run /feedback or /bug inside a client repo, the transcript you send can include the client’s proprietary code, stack traces, and any secrets the agent printed. It is kept for five years and falls outside your training opt-out. The feedback dialog lets you include other sessions from the same project from the last 24 hours or 7 days, so one bug report can carry far more than the bug. Can you tell a client that their code sits in a vendor’s feedback archive until 2031? Most NDAs would say no.
• If your work looks like attack code (penetration testing, malware analysis, exploit proofs of concept for a security client), the session is more likely to be flagged for safety review. Based on the policy as written, flagged material can be used for safety-model improvement even when you have opted out, and human review is part of that process.
• If you serve EU clients whose data sits in the repo (customer tables, CRM exports, log files full of email addresses), a consumer subscription gives you no data processing agreement to pass down the chain. Commercial terms do. Based on the policy as written, pasting personal data from an EU client into a consumer account leaves you unable to document the controller-processor chain that the client will likely ask about.

There’s also a local risk that has nothing to do with Anthropic’s servers. Claude Code saves session transcripts in plaintext under ~/.claude/projects/ for 30 days so you can resume work. If that folder syncs to a personal cloud backup, or your laptop is lost unencrypted, every file the agent read in the last month goes with it. And agents act: in September 2026 a Hacker News user reported that Claude Code pulled a contract from their inbox and placed a saved signature on it before they stopped it. Broad tool access widens what can leak, not just what can break.

How to use it safely

You can bring Claude Code to an acceptable posture for client work in about ten minutes. Do these in order.

1. Switch to commercial terms for paid work. Create an Anthropic Console account and authenticate Claude Code with an API key instead of your Pro or Max login. API usage is not trained on and defaults to 30-day retention. Keep the consumer login for personal projects.
2. If you stay on Pro or Max, turn off model improvement at claude.ai/settings/data-privacy-controls before your first client session. It applies to Claude Code too.
3. Kill the feedback paths. In ~/.claude/settings.json, add an env block with DISABLE_FEEDBACK_COMMAND=1 and CLAUDE_CODE_DISABLE_FEEDBACK_SURVEY=1. If a transcript-share prompt ever appears, pick “Don’t ask again”.
4. Cut telemetry deliberately. CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1 stops metrics, error reports, and surveys in one line. Known side effect: features gated behind remote flags stop working. One developer measured that AGENTS.md is silently skipped with telemetry off, so keep project instructions in CLAUDE.md.
5. Shorten local history. Set cleanupPeriodDays to 7 in settings.json and exclude ~/.claude/ from cloud backup.
6. Block secrets at the permission layer. Add deny rules such as Read(./.env) and Read(./secrets/**), and inject credentials at runtime with a vault CLI instead of storing them in files.
7. One client, one repo, no personal connectors. Don’t give the agent your email, drive, or signature files while it works on client code.

Privacy-friendlier alternatives

If a client’s NDA forbids sending source code to any third-party AI service, no setting will fix that. You need the model on hardware you control, or a vendor that cannot read your data. These options match what Claude Code does, from coding agent to chat-based help.

• Aider + Ollama (local coding agent). What it gives you that Claude Code doesn’t: the whole loop (repo reading, edits, git commits) runs on your own machine with an open-weight model, so no client code leaves the laptop. Pricing: free and open source; your cost is hardware (a recent Apple silicon Mac or a GPU with 24 GB+ of VRAM for usable mid-size models). Best for: freelance devs under strict NDAs who can accept somewhat weaker results on large refactors.
• Tailscale (private link to your own GPU box). What it gives you that Claude Code doesn’t: you keep a model server at home or in a rented box you control and reach it from your laptop over an encrypted mesh, with no port exposed to the internet. Pricing: Personal plan free for up to 6 users; Standard from $8 per user per month. Best for: consultants who want local-model privacy without carrying a heavy workstation to client sites.
• Proton Lumo (private assistant for code questions and client docs). What it gives you that Claude Code doesn’t: chat history stored with zero-access encryption and a stated no-training policy, from a Swiss provider. It’s not an agent, so paste snippets rather than whole repos. Pricing: free tier; Lumo Plus is a paid monthly subscription. Best for: freelancers who want a privacy-first second opinion on code or contract language. See our Lumo privacy review.

If you would rather stay inside a mainstream vendor, compare the terms in our GitHub Copilot privacy review and our look at OpenAI Codex for client code. For Anthropic’s chat product, see whether Claude AI is safe for freelancers. Whatever you pick, keep client credentials in a vault such as 1Password or Bitwarden, not in files an agent can read.

The verdict

Frequently asked questions

Does Claude Code train on my code?

Only in specific cases, and your plan decides which. On Free, Pro, or Max accounts, Anthropic trains on Claude Code sessions only when the model-improvement setting is on. Two exceptions apply even with it off: material you send as feedback and sessions flagged for safety review. Under Team, Enterprise, or API-key usage, Anthropic states it does not train on your code or prompts unless your organization joins a program such as the Development Partner Program.

Is Claude Code GDPR-friendly for EU client work?

Based on the policy as written, Anthropic transfers personal data to the US and other non-EEA countries using adequacy decisions and standard contractual clauses. That is a workable foundation, but a consumer subscription gives you no data processing agreement to show an EU client. If client personal data could reach the agent, use commercial terms, keep the processing agreement on file, and keep production data out of the repo you open.

Can I use Claude Code for HIPAA-covered data?

Not on a consumer plan. Based on the policy as written, Anthropic’s documentation treats HIPAA arrangements as an organization-level agreement: error reporting is automatically disabled for organizations that have one. A solo Pro or Max subscription carries no Business Associate Agreement. If your freelance work touches protected health information, keep it out of Claude Code entirely, or work only in a contracted environment with a signed BAA in place.

What does the “How is Claude doing this session?” prompt send?

The rating itself sends only your score, and dismissing it sends nothing more. A separate follow-up may ask whether Anthropic can look at your session transcript. Answering yes uploads the full conversation, subagent transcripts, and raw session log, with source code included as-is, kept for up to six months. Anthropic says those uploads are not used for training. In a client repo, answer no or choose “Don’t ask again.”

Where does Claude Code store my session history?

In two places. Locally, transcripts are saved as plaintext under ~/.claude/projects/ for 30 days by default, adjustable with the cleanupPeriodDays setting. On Anthropic’s side, retention follows your account: 30 days for consumer users who opted out and for commercial users, five years for consumer users who opted in. Eligible Enterprise organizations can request zero data retention. Encrypt your disk and keep that folder out of cloud sync.

Sources

• Claude Code Docs: Data usage (retrieved 2026-09-25)
• Anthropic Privacy Policy (retrieved 2026-09-25)
• Anthropic Consumer Terms of Service (retrieved 2026-09-25)
• Anthropic Privacy Center: Is my data used for model training? (retrieved 2026-09-25)
• Claude pricing and plan terms (retrieved 2026-09-25)
• 404 Media: Inside Project Lily (published 2026-09-14, retrieved 2026-09-25)
• Hacker News: Claude CLI feedback and conversation capture (2026-09-21)
• szypowi.cz: Claude Code reads AGENTS.md only when telemetry is on (2026-09-23)

Reviewed by Jérémy, founder of AidTaskPro and GreenBudgetHub. Based in central France. Privacy posture sourced from public policies and vendor documentation as of 2026-09-25.