Claude Code privacy: what leaves the laptop

Claude Code sends every prompt and every model reply to Anthropic; that is how it works, on every plan. What Anthropic then does with them is the plan's terms: on Free, Pro and Max a setting decides whether they train models and whether they are kept 30 days or 5 years; on Team, Enterprise and the API they are not trained on and are kept 30 days, or not at all under zero data retention. A second stream, the company's own telemetry, is what names a person: the signed-in email on every metric and event, to a collector the company runs. A third, a measurement tool, adds whatever its schema has a field for. This page lists the three from Anthropic's pages read on 30 October 2026, and states Caprock's own boundary.

Three layers a security reviewer asks about

A review of Claude Code is three questions with three owners. Anthropic's terms govern the first; the company's own configuration the second; whoever makes the measurement tool the third. Answering one with the documents of another is where reviews stall.

Layer 1: what Claude Code sends to Anthropic, and what Anthropic keeps

What goes. "Claude Code runs locally. To interact with the LLM, Claude Code sends data over the network. This data includes all user prompts and model outputs, encrypted in transit via TLS 1.2+." The request is the whole conversation so far: "The bodies contain the full conversation history, including the system prompt, every prior user and assistant turn, and tool results". A file Claude read and a command's output travel in it, not only the line you typed. Anthropic's data-usage page, read 30 October 2026.

Training, by plan. The same page: "We give you the choice to allow your data to be used to improve future Claude models. We will train new models using data from Free, Pro, and Max accounts when this setting is on (including when you use Claude Code from these accounts)." And for commercial users, Team and Enterprise plans, the API, third-party platforms and Claude Gov: "Anthropic does not train generative models using code or prompts sent to Claude Code under commercial terms, unless the customer has chosen to provide their data to us for model improvement". The Commercial Terms, effective 17 June 2025: "Anthropic may not train models on Customer Content from Services." The Consumer Terms, effective 8 October 2025: "We may use Materials to provide, maintain, and improve the Services and to develop other products and services, including training our models, unless you opt out of training through your account settings." The same clause names two exceptions, feedback you send and sessions flagged for safety review. The consumer setting is at claude.ai/settings/data-privacy-controls.

Retention, by plan. From the data-usage page and the Privacy Center's consumer article, read 30 October 2026:

• Free, Pro and Max. 5 years when the training setting is on, 30 days when it is off. A conversation you delete is "Deleted from our back-end storage systems within 30 days". A session flagged by the trust and safety systems is the exception: "We retain inputs and outputs for up to 2 years and trust and safety classification scores for up to 7 years if your chat or session is flagged by our automated trust and safety systems as violating our Usage Policy".
• Team, Enterprise and the API. 30 days as standard. Zero data retention: "When ZDR is enabled, prompts and model responses generated during Claude Code sessions are processed in real time and not stored by Anthropic after the response is returned, except where needed to comply with law or combat misuse." "ZDR is not included in the standard Claude for Enterprise plan and cannot be enabled from your admin settings." It is enabled per organization by the account team, and "ZDR for Claude Code on Claude for Enterprise applies only to Anthropic's direct platform."
• What you send yourself. A /feedback, /bug or /share transcript is kept 5 years; a transcript shared after the session quality survey, up to 6 months. "When you run the /feedback command, a copy of your conversation history including code is sent to Anthropic. The /bug and /share commands submit through the same path." DISABLE_FEEDBACK_COMMAND=1 removes the command; CLAUDE_CODE_DISABLE_FEEDBACK_SURVEY=1 removes the survey.

The files on the laptop. "Claude Code clients store session transcripts locally in plaintext under ~/.claude/projects/ for 30 days by default to enable session resumption. Adjust the period with cleanupPeriodDays." The ~/.claude directory page says what is in them: "Anything that passes through a tool is written to a transcript on disk: file contents, command output, pasted text." and "Transcripts and history are not encrypted at rest. OS file permissions are the only protection. If a tool reads a .env file or a command prints a credential, that value is written to projects/<project>/<session>.jsonl." history.jsonl beside them holds "Prompts you've typed, with timestamp and project path." The sweep runs at cleanupPeriodDays, default 30, minimum 1; it does not reach a session from Claude Desktop or Cowork ("Claude Code keeps the transcript of a session you started or most recently continued in Claude Desktop or Cowork at any age.") unless desktopSessionCleanupPeriodDays is set or managed settings set the period. These files are the record a reviewer can inspect, and the files a tool on the machine reads.

Operational telemetry. Two streams, each with a switch, on the data-usage page. "Metrics: latency, reliability, and usage patterns, sent to Anthropic and to third-party logging infrastructure over TLS. Metrics never include your code, prompts, or file paths. Set DISABLE_TELEMETRY=1 to opt out." Error reports are "error messages and stack traces from Claude Code's own internals, sent to a third-party error tracking service over TLS. Claude Code redacts known patterns of secrets, file paths, email addresses, and other personal information before anything leaves your machine. Set DISABLE_ERROR_REPORTING=1 to opt out." They are on only when you sign in with a Claude Pro or Max subscription, you're running Claude Code v2.1.198 or later, you're connecting directly to the Claude API and your organization doesn't have a zero data retention or HIPAA agreement. CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1 turns off every non-essential call at once. One check stays on regardless: before a WebFetch, the hostname goes to api.anthropic.com against a blocklist; "Only the hostname is sent, not the full URL, path, or page contents." skipWebFetchPreflight: true in settings removes it.

Bedrock, Vertex and Foundry. "By default, error reporting, telemetry, and bug reporting are disabled when using Amazon Bedrock, Google Cloud's Agent Platform, Microsoft Foundry, or Claude Platform on AWS." The prompts go to the cloud you chose, under its keys: Bedrock, "AES-256 with AWS-managed keys. Customer-managed keys available via AWS KMS." Vertex, "Google-managed encryption keys. CMEK available." Foundry hosted on Azure, "For Hosted on Azure deployments, prompts and completions remain within Azure; only usage metadata and content flagged by Anthropic's safety systems egress to Anthropic." On these providers /feedback writes to ~/.claude/feedback-bundles/ on the machine instead of sending, and the Development Partner Program does not apply: "this program is available only for Anthropic first-party API, and not for Amazon Bedrock or Google Cloud's Agent Platform users". Anthropic's own analytics do not see this usage either, which is the next layer.

Layer 2: what the company's telemetry adds about a person

Anthropic's stream above carries no code and no email. The company's own two sources are where a person appears.

The OpenTelemetry export. Off until configured, and when on, every metric and event carries the standard attributes. From the monitoring page, read 30 October 2026:

• The email has no switch. "When authenticated via OAuth, user.email is included in telemetry attributes, sent only to the OTel endpoint you configure, never to Anthropic. If this is a concern for your organization, work with your telemetry backend to filter or redact this field". The collector's attributes processor with key: user.email and action: delete does that before anything is stored; the full configuration is in Claude Code OpenTelemetry.
• Two switches. OTEL_METRICS_INCLUDE_ACCOUNT_UUID=false drops the account; OTEL_METRICS_INCLUDE_SESSION_ID=false drops the session. organization.id and user.id stay, and user.id is a random installation id, "Random anonymous identifier generated on first run and persisted in ~/.claude.json. It contains no personal information and is not derived from your Claude account."
• Content is a separate decision. "Raw file contents and code snippets are not included in metrics or events." "User prompt content is not collected by default. Only prompt length is recorded." OTEL_LOG_USER_PROMPTS=1, OTEL_LOG_ASSISTANT_RESPONSES=1, OTEL_LOG_TOOL_DETAILS=1 and OTEL_LOG_RAW_API_BODIES each add content, to your collector only. A repository cannot set them: "Claude Code ignores the OpenTelemetry exporter variables in a repository's .claude/settings.json and .claude/settings.local.json, so a repository can't use them to turn telemetry on, choose where it goes, or capture content."
• The repository is opt-in. OTEL_METRICS_INCLUDE_REPOSITORY=true, Claude Code v2.1.269 or later, adds the origin remote's name, owner and URL. "The attributes flow only to your own exporters; Anthropic's telemetry drops every vcs.* key."

Anthropic's analytics dashboards. On Team and Enterprise the dashboard includes "Usage metrics, contribution metrics with GitHub integration, leaderboard, data export"; "Admins and Owners can view the dashboard." The leaderboard is "top contributors ranked by Claude Code usage", the top 10, and the CSV behind it is not capped: "The export includes all users, not just the top 10 displayed." Contribution metrics need the Claude GitHub app, and "These metrics only cover users within your claude.ai organization. Usage through the Claude Console API or third-party integrations is not included." On the Console the team insights table lists "all users who have authenticated to Claude Code. API key users display by key identifier, OAuth users display by email address." Each row carries "Spend this month" and "Lines this month", for the Developer, Billing, Admin, Owner, and Primary Owner roles, and "Spend figures in the Console dashboard are estimates for analytics purposes." The Team and Enterprise dashboard shows no cost: "For per-user token counts and cost estimates, configure OpenTelemetry export". On Enterprise the Analytics API "returns per-user engagement, usage, and cost reports for your organization across Claude surfaces, including Claude Code"; "The API is not available on the Teams plan." And "Contribution metrics are not available for organizations with Zero Data Retention enabled." What each surface shows, side by side: Claude Code analytics.

Layer 3: what a measurement tool adds: Caprock's boundary

A tool that reads the transcript files above can carry anything in them. The question for the reviewer is what its schema has a field for, and where the rows go.

On one machine. Caprock reads the ~/.claude/projects/*/*.jsonl files and keeps what it computes in a SQLite file on the same disk: every session, priced at list from a dated table, in its repository's row. Nothing leaves your machine. No account, no cloud, no telemetry. What can leave, each only when you press the button, is listed with what it sends on Caprock's privacy page: a bug report you wrote, a survey answer, the week card you chose to post, a release check the app asks about once, and a paired phone through a relay that carries ciphertext. Sessions that run in a vendor's cloud or inside CI are not observed; Caprock sees the machines it is installed on.

The form an aggregate takes. Sums without content and without per-person rows: cost and sessions per repository, per pull request, per release, per week. Thirty days on my Mac, 29 September to 28 October 2026, as the team ledger would hold them:

30

daily totals, one row each

$21.45

29 September, the lowest day

$669.90

14 October, the highest day

Across a team. The team server is one binary on a server you run, inside your network, behind your own VPN or SSO. Nothing is sent to Caprock. The team payload has no field for prompts, replies or tool output, so a misconfiguration cannot leak one. The team screen counts work, not people: cost and sessions per repository, per pull request and per release. A per-person view is a switch the team turns on and documents, never the default. Every developer sees the same aggregates the lead sees, and sees what leaves the laptop. Beside the collector, the two keep different books: the collector the per-user token series the company configured, Caprock for Teams cost per repository and pull request however the company pays, with sessions recorded whether or not a variable was set. Buying Caprock is one flat price for the team.

What to hand the reviewer

Documents and settings, each dated; no legal claims.

• Anthropic's pages, with the date you read them. The data-usage page; the Commercial or Consumer Terms for your plan; the Privacy Policy; for a consumer plan the Privacy Center retention article; for Enterprise the zero data retention page and the account team's confirmation, if any.
• The security page's controls, as configured. The permission mode sessions start in ("A separate classifier model reviews actions instead of you and blocks the ones it judges unsafe." or "Claude Code starts with read-only permissions. When it needs to edit files, run tests, or execute commands, it asks you first"), the sandbox and the working directory boundary, where credentials sit ("API keys and tokens are stored in the macOS Keychain when available. On Linux they're stored in a file with mode 0600, and on Windows in a file that inherits the access controls of your user profile directory."), and "Audit or block settings changes during sessions with ConfigChange hooks". Anthropic's own attestations are at its Trust Center: "Learn more and access resources (SOC 2 Type 2 report, ISO 27001 certificate, etc.) at Anthropic Trust Center".
• The managed settings file. cleanupPeriodDays and desktopSessionCleanupPeriodDays; DISABLE_TELEMETRY, DISABLE_ERROR_REPORTING or CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC; DISABLE_FEEDBACK_COMMAND; the OTEL_* block if any, and which OTEL_LOG_* variables are unset. Managed settings pin the destination: "when you set OTEL_EXPORTER_OTLP_ENDPOINT, Claude Code removes every developer-set per-signal endpoint."
• The collector. Its configuration with the attributes processor that deletes user.email, who can query it, and its own retention period, which no Anthropic page sets.
• The dashboards. Which roles hold Admin or Owner on claude.ai, or UsageView on the Console; whether the leaderboard and the all-users export are in use; whether usage credits are on, since that is when the spend report prices people.
• The measurement tool's schema. For Caprock: the privacy page, the team design in .ai/17-teams.md and ADR-088 in the public repository, which state the payload's fields and the switch.

Security and compliance pages describe controls; this page describes data. Anthropic's own caution applies to all three layers: "no system is completely immune to all attacks".