Windsurf (Codeium)
Graded against 804 verified platforms, from its own policy text. Automated assessment against a published rubric — not legal advice.
“Legitimate Interests — specifically, our interest in ensuring you have the best use of the Services To promote safety, security, and integrity of our Services Basic Information, Account Information, Communications, App, browser, and device information, Services usage data, Additional information you submit to us Legitimate Interests — specifically, our…”
Watch: Data retention
Start here. These are the highest-risk verified clauses AIRIN found in the platform's own policy text.
The deletion right is not absolute — it is subject to all the retention justifications enumerated above. Users requesting deletion may find their data retained under legitimate interests, legal obligation, or safety grounds.
The retention policy lacks any specified timeframes. 'Protect ours or others interests' is undefined and could justify indefinite retention. The safety/security carve-out also permits retention even after users request deletion.
Creates an exception for no-ZDR model usage where User Content may be stored solely to provide the Service, and acknowledges that enabling persistent features like Memories or Rules requires storage of associated User Content, establishing conditional retention rules.
Scores derived from 30 enriched findings — same verbatim citations as below. AI-generated, not legal advice.
- Windsurf (Codeium)'s training terms are conditional — check the tier, opt-out, and enterprise exceptions before relying on protection.
- Output ownership has conditions — review the commercial use and license carve-outs before building on these outputs.
- Data handling is conditional — 4 privacy or retention clauses warrant review before using Windsurf (Codeium) at scale.
Derived from AI-enriched analysis of the verified findings below — informational only, not legal advice.
How to read this page: Overall risk rates what Windsurf (Codeium)'s own policy terms mean for your prompts, outputs, and data. The benchmark bands below grade those same verified terms relative to peers — a platform in a risky-by-default category can rate HIGH risk and still grade STRONG against its peer set. Both trace to the cited findings.
Policy benchmark
rubric v1.0 — how this is scoredBased on 114 verified, verbatim-cited findings below — read the citations.
Based on 135 verified, verbatim-cited findings below — read the citations.
Automated assessment against a published rubric — not legal advice.
Fully verified — complete core corpus captured and read in full.
- Privacy PolicyVerified - read in full - 21 citationsstaticLast captured 2026-07-03
- Terms of ServiceVerified - read in full - 47 citationsstaticLast captured 2026-07-03
Only citation-backed plan differences are shown here; absent cells mean AIRIN has not verified a tier-specific claim.
Grants Exafunction the right to collect, generate, and derive Usage Data for business purposes including service improvement and product development, asserts Exafunction's ownership of all intellectual property in Usage Data and analytical results, and prohibits user interference with Usage Data collection.
" 11. Usage and User Content. Exafunction may collect, generate, and derive Usage Data for Exafunction's lawful business purposes, including to: (1) monitor, operate, improve, and support the Service and its performance, security, and stabil..."
Defines the scope and parties of the Privacy Policy, identifies the controller (Cognition AI, Inc.), and enumerates the Services covered, establishing the operative definitions for the entire document.
" This Privacy Policy explains how Cognition AI, Inc (“ we ”, “ our ” or “ us ”) collect, use, disclose, and safeguard your information when you use visit our website (www.cognition.ai), our software-as-a-service offerings that we make avail..."
This segment permits Exafunction's support team to review user inputs and refine responses to improve Service quality, and establishes a force majeure exception relieving both parties of liability for delays caused by events beyond their reasonable control, with Exafunction retaining the right to immediately terminate the Service on such grounds.
"Additionally, our support team may review input and refine responses to improve the quality and relevance of the information provided. 21.9. Force Majeure. Neither party is liable for any delay or failure to perform any obligation under th..."
Describes payment obligations for the paid Individual license tier, establishes that fees are non-refundable in USD, and incorporates Order Form pricing terms, creating financial obligations and tier distinctions between free and paid users.
" 5. General Payment Terms. We offer a paid version of this Individual license, which includes enhanced features. Before you pay any fees, you will have an opportunity to review and accept the fees that you will be charged. In some cases, yo..."
This segment imposes an obligation on users to comply with all applicable trade control laws and restrictions, and prohibits export, re-export, or transfer of the Service or its outputs to restricted persons or entities, creating compliance obligations and restrictions tied to regulatory requirements.
"You agree to comply with all applicable Trade Controls in using any Service and Suggestions. Specifically, you represent and warrant that you will not export, re-export, or transfer (in-country) to or otherwise allow the use of the Service,..."
This segment establishes the procedural steps for counter-notification under the DMCA, describing Exafunction's obligation to forward the counter notification to the original complainant and restore removed content, governing the copyright enforcement process.
" A party submitting a Counter Notification should consult a lawyer or see 17 U.S.C. § 512 to confirm the party's obligations to provide a valid counter notification under the Copyright Act. 14.6. Reposting of Content Subject to a Counter N..."
This segment cross-references the Teams Terms of Service, incorporating a separate agreement applicable to a different service tier, distinguishing Individual/Pro from Teams arrangements.
" Interested in Teams? Check out the Teams Terms of Service ."
This segment provides contact information for Exafunction and describes the procedure for California residents to seek consumer complaint assistance under California Civil Code Section 1789.3, establishing a regulatory compliance procedure.
" 21.6. Contact Information. The Service is offered by Exafunction, Inc., located at 900 Villa Street, Mountain View, CA 94041. You may contact us by sending correspondence to that address or by emailing us at hello@windsurf.com. 21.7. Noti..."
Evidence appendix
Showing priority citations first. The full appendix is available for audit trails; not every citation is a severe risk.
" you elect to use a model labeled "(no ZDR)", we or the provider may store User Content solely to provide the Service to you, and if you enable features that explicitly require persistent code snippets or conversation history (e.g., Memories, Rules, or similar features), you acknowledge that the associated User Content will be stored as necessary to provide those features."
Creates an exception for no-ZDR model usage where User Content may be stored solely to provide the Service, and acknowledges that enabling persistent features like Memories or Rules requires storage of associated User Content, establishing conditional retention rules.
AI-generated interpretation, not legal advice.
"Legitimate Interests — specifically, our interest in ensuring you have the best use of the Services To promote safety, security, and integrity of our Services Basic Information, Account Information, Communications, App, browser, and device information, Services usage data, Additional information you submit to us Legitimate Interests — specifically, our interest in ensuring and maintain the effective operations and delivery of the Services To comply with legal and regulatory obligations. We may access, read, preserve, and disclose information when we believe it is reasonably necessary to comply with law, legal obligations, regulations, law enforcement, governmental, and other legal requests, court orders, or for disclosure to tax authorities Basic Information, Account Information, Communications, App, browser, and device information, Services usage data, Additional information you submit to us To comply with our legal obligations. Legitimate Interests — specifically, our interest in complying with legal obligations, requests and our corporate responsibilities where we operate To customize your experience with our Services and otherwise improve our Services including, depending on the terms that apply to your use of the Services, using User Content to train, fine tune and improve the models that power our Services. Basic Information, Account Information, Communications, App, browser, and device information, Services usage data, and User Content Legitimate Interests — specifically, it is in our interest to understand how you interact with the Services in order to customize and/or improve our products and Services, and the models that power our Services, and enable accurate and reliable reporting Where not otherwise required by law, and depending on the"
Specifies legitimate interest bases for processing personal data for safety, security, integrity, and legal/regulatory compliance purposes, and permits access, reading, preservation, and disclosure of information when legally necessary.
AI-generated interpretation, not legal advice.
" 10.1. Use of Autocomplete User Content to Improve Services. We may use your Autocomplete User Content to improve our discriminative machine learning models, which are models that rank or assign scores to code generations in order to understand the boundaries between different sets of code. We will never use your Autocomplete User Content to improve generative machine learning models, which are models that are able to generate code directly based on studying existing code generations, for Autocomplete or other services. Any Autocomplete User Content used for training our discriminative machine learning models is anonymized, such that any personally identifiable information is removed. To opt out of having your Autocomplete User Content used for such purpose, you may change the code sharing options in the User Settings pane of the user's profile page. Please note that if you opt out, your Autocomplete User Content will be sent to our servers so that we are able to provide you with the Services, but we will not retain your Autocomplete User Content on our servers for training our discriminative machine learning models. "Autocomplete User Content" mean User Content provided to the Service in the operation of the Autocomplete feature. 10.2. Use of Chat User Content to Improve Services. We may use your Chat User Content to improve the generative and discriminative machine learning models we use. Any Chat User Content used for training our machine learning models is anonymized, such that any personally identifiable information is removed. "
Permits Exafunction to use Autocomplete User Content to improve discriminative machine learning models, while expressly restricting its use for generative model training for Autocomplete or other services, and specifies anonymization requirements for any training data used.
AI-generated interpretation, not legal advice.
" 11. Usage and User Content. Exafunction may collect, generate, and derive Usage Data for Exafunction's lawful business purposes, including to: (1) monitor, operate, improve, and support the Service and its performance, security, and stability; (2) create analytics, benchmarking, and performance data and reports; and (3) develop new products and services. You will not interfere with the collection of Usage Data. Exafunction owns all right, title, and interest, including all intellectual property rights in and to, the Usage Data, the know-how and analytical results generated in the processing and use of Usage Data, and any and all new products, services, and developments, modifications, customizations, or improvements to the Service made based on the Usage Data. Exafunction will not disclose Usage Data externally, including in benchmarks or reports, unless such Usage Data has been (a) de-identified so that it does not individually identify you or any other person and (b) aggregated with usage data from other users of the Platform. "Usage Data" means any performance, analytical, or usage data or information relating to access to or use of the Service that is generated or otherwise collected by the Service but excluding User Content. For Pro Users, you may elect to place limits on the use of User Content such that User Content (i) is transmitted only to generate code, outputs, or other functions generated in response to input User Content ("Suggestions") in real-time and are deleted once Suggestions are generated; (ii) is not used for any other purpose, including the training of language models; and (iii) is encrypted during transit and is not stored at rest. These limits control over the usage rights referenced in Section 10 above. Notwithstanding the foregoing, if"
Grants Exafunction the right to collect, generate, and derive Usage Data for business purposes including service improvement and product development, asserts Exafunction's ownership of all intellectual property in Usage Data and analytical results, and prohibits user interference with Usage Data collection.
AI-generated interpretation, not legal advice.
"Additionally, our support team may review input and refine responses to improve the quality and relevance of the information provided. 21.9. Force Majeure. Neither party is liable for any delay or failure to perform any obligation under these Terms (except for a failure to pay fees) due to events beyond its reasonable control, such as a strike, blockade, war, pandemic or threat thereof, act of terrorism, riot, Internet or utility failures, refusal of government license, or natural disaster ("Force Majeure Events"). Exafunction may terminate the use of the Service immediately with notice if it reasonably believes or determines that the provision of the Service to you is prohibited by applicable law. 21.10. International Use. The Service is intended for visitors located within the United States. We make no representation that the Service is appropriate or available for use outside of the United States. Access to the Service from countries or territories or by individuals where such access is illegal is prohibited. 21.11. Export. You acknowledge and understand that the Service and Suggestions are subject to U.S. export control and sanctions laws and regulations, including but not limited to the U.S. Department of Commerce's Export Administration Regulations and trade and economic sanctions maintained by the Office of Foreign Assets Control ("OFAC") at the U.S. Department of the Treasury, and may be subject to foreign export and import Laws (collectively, "Trade Controls"). "
This segment permits Exafunction's support team to review user inputs and refine responses to improve Service quality, and establishes a force majeure exception relieving both parties of liability for delays caused by events beyond their reasonable control, with Exafunction retaining the right to immediately terminate the Service on such grounds.
AI-generated interpretation, not legal advice.
" We are constantly trying to improve our Services, so we may need to change this Privacy Policy from time to time as well. We post any changes we make to our Privacy Policy on this page and, where appropriate, we will provide you with reasonable notice of any material changes or as otherwise required by law. The date the Privacy Policy was last updated is identified at the top of this page."
Describes Cognition's procedure for updating the Privacy Policy, including posting changes on the website and providing reasonable notice of material changes, establishing the mechanism by which policy modifications are communicated to users.
AI-generated interpretation, not legal advice.
" 5.1. Price. Exafunction reserves the right to determine pricing for the Service. Exafunction will make reasonable efforts to keep pricing information published on the Service up to date. We encourage you to check our pricing page periodically for current pricing information. Exafunction may change the fees for any feature of the Service, including additional fees or charges, if Exafunction gives you advance notice of changes before they apply. Exafunction, at its sole discretion, may make promotional offers with different features and different pricing to any of Exafunction's customers. These promotional offers, unless made to you, will not apply to your offer or these Terms. 5.2. Authorization. You authorize Exafunction to charge all sums for the orders that you make and any level of Service you select as described in these Terms or published by Exafunction, including all applicable taxes, to the payment method specified in your account. If you pay any fees with a credit card, then Exafunction may seek pre-authorization of your credit card account prior to your purchase to verify that the credit card is valid and has the necessary funds or credit available to cover your purchase. 5.3. Subscription Service. The Service may include certain subscription-based plans with automatically recurring payments for periodic charges ("Subscription Service"). The "Subscription Billing Date" is the date when you purchase your first subscription to the Service. "
Grants Exafunction the right to set, change, and make promotional pricing for the Service, while imposing a notice obligation before fee changes apply, and distinguishes pricing across different customer tiers.
AI-generated interpretation, not legal advice.
" We implement commercially reasonable technical, administrative, and organizational measures intended to protect personal information both online and offline from loss, misuse, and unauthorized access, disclosure, alteration, or destruction. However, these measures are not a guarantee of absolute security and you acknowledge and accept that your use of our Services is ultimately at your own risk."
Describes commercially reasonable security measures implemented to protect personal information but disclaims any guarantee of absolute security and places residual risk on the user, limiting Cognition's liability for security failures.
AI-generated interpretation, not legal advice.
" 6.1. Limited License. Subject to your complete and ongoing compliance with these Terms, and the payment of the applicable Fee (for Pro Users), Exafunction grants you, solely for your personal use, a limited, non-exclusive, non-transferable, non-sublicensable, revocable license to: (a) install and use one object code copy of any downloadable application that we provide to you, on a device that you own or control; and (b) access and use the Service. 6.2. License Restrictions. Except and solely to the extent such a restriction is impermissible under applicable law, you may not: (a) reproduce, distribute, publicly display, publicly perform, or create derivative works of the Service; (b) make modifications to the Service; or (c) interfere with or circumvent any feature of the Service, including any security or access control mechanism. If you are prohibited under applicable law from using the Service, then you may not use it. 6.3. Feedback. We respect and appreciate the thoughts and comments from our users. If you choose to provide input and suggestions regarding existing functionalities, problems with or proposed modifications or improvements to the Service ("Feedback"), then you hereby grant Exafunction an unrestricted, perpetual, irrevocable, non-exclusive, fully-paid, royalty-free right and license to exploit the Feedback in any manner and for any purpose, including to improve the Service and create other products and services. We will have no obligation to provide you with attribution for any Feedback you provide to us."
Grants users a limited, non-exclusive, non-transferable, revocable license to install and use the Service solely for personal use, conditioned on compliance and fee payment for Pro users, and restricts reproduction, distribution, and other uses beyond those expressly permitted.
AI-generated interpretation, not legal advice.
"In line with these considerations, we delete information that is no longer needed for the above purposes or when you request deletion of your information."
The deletion right is not absolute — it is subject to all the retention justifications enumerated above. Users requesting deletion may find their data retained under legitimate interests, legal obligation, or safety grounds.
AI-generated interpretation, not legal advice.
"We retain your personal information as needed to provide our Service to you, comply with legal obligations, or protect ours or others interests. How long we retain personal information includes considerations such as when the information was collected or created, whether it is necessary in order to continue offering you our Services, whether we are required to hold the information to comply with our legal obligations, or information preservation requirements. We also keep certain information where necessary to protect the safety, security, and integrity of our Services or users."
The retention policy lacks any specified timeframes. 'Protect ours or others interests' is undefined and could justify indefinite retention. The safety/security carve-out also permits retention even after users request deletion.
AI-generated interpretation, not legal advice.
"You may elect to post content to hosting providers with which we have formed relationships. In doing so, you represent that this content does not violate the intellectual property rights of others, and agree to indemnify us for any third party claims that may result from a violation of this representation."
This is a classic indemnification clause placing the financial burden of third-party IP claims squarely on the user. If a third party asserts copyright or other IP infringement against Exafunction based on content the user deployed, the user is contractually obligated to defend and hold harmless the platform. The risk is elevated because the representation is binary (does/does not violate) and AI-generated content IP ownership is contested terrain.
AI-generated interpretation, not legal advice.
"TO THE FULLEST EXTENT PERMITTED BY LAW, IN NO EVENT WILL THE EXAFUNCTION ENTITIES BE LIABLE TO YOU FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL OR PUNITIVE DAMAGES (INCLUDING DAMAGES FOR LOSS OF PROFITS, GOODWILL, OR ANY OTHER INTANGIBLE LOSS) ARISING OUT OF OR RELATING TO YOUR ACCESS TO OR USE OF, OR YOUR INABILITY TO ACCESS OR USE, THE SERVICE OR ANY MATERIALS OR CONTENT ON THE SERVICE, INCLUDING SUGGESTIONS, WHETHER BASED ON WARRANTY, CONTRACT, TORT (INCLUDING NEGLIGENCE), STATUTE, OR ANY OTHER LEGAL THEORY, AND WHETHER OR NOT ANY EXAFUNCTION ENTITY HAS BEEN INFORMED OF THE POSSIBILITY OF DAMAGE."
This is a standard but very broad consequential-damages waiver applied across all theories of liability. For commercial users who rely on the service, the inability to recover lost profits or goodwill is a significant risk allocation.
AI-generated interpretation, not legal advice.
" 18.3. THE LIMITATIONS, EXCLUSIONS AND DISCLAIMERS IN THIS SECTION 18 APPLY TO THE FULLEST EXTENT PERMITTED BY LAW. Exafunction does not disclaim any warranty or other right that Exafunction is prohibited from disclaiming under applicable law."
This segment clarifies that all disclaimers and limitations in Section 18 apply to the fullest extent permitted by law, while carving out any warranties Exafunction is legally prohibited from disclaiming, setting the outer boundary of the disclaimer provisions.
AI-generated interpretation, not legal advice.
" 19.1. TO THE FULLEST EXTENT PERMITTED BY LAW, IN NO EVENT WILL THE EXAFUNCTION ENTITIES BE LIABLE TO YOU FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL OR PUNITIVE DAMAGES (INCLUDING DAMAGES FOR LOSS OF PROFITS, GOODWILL, OR ANY OTHER INTANGIBLE LOSS) ARISING OUT OF OR RELATING TO YOUR ACCESS TO OR USE OF, OR YOUR INABILITY TO ACCESS OR USE, THE SERVICE OR ANY MATERIALS OR CONTENT ON THE SERVICE, INCLUDING SUGGESTIONS, WHETHER BASED ON WARRANTY, CONTRACT, TORT (INCLUDING NEGLIGENCE), STATUTE, OR ANY OTHER LEGAL THEORY, AND WHETHER OR NOT ANY EXAFUNCTION ENTITY HAS BEEN INFORMED OF THE POSSIBILITY OF DAMAGE. 19.2. EXCEPT AS PROVIDED IN SECTIONS 20.5 AND 20.6 AND TO THE FULLEST EXTENT PERMITTED BY LAW, THE AGGREGATE LIABILITY OF THE EXAFUNCTION ENTITIES TO YOU FOR ALL CLAIMS ARISING OUT OF OR RELATING TO THE USE OF OR ANY INABILITY TO USE ANY PORTION OF THE SERVICE OR OTHERWISE UNDER THESE TERMS, WHETHER IN CONTRACT, TORT, OR OTHERWISE, IS LIMITED TO THE GREATER OF: (a) THE AMOUNT YOU HAVE PAID TO EXAFUNCTION FOR ACCESS TO AND USE OF THE SERVICE IN THE 12 MONTHS PRIOR TO THE EVENT OR CIRCUMSTANCE GIVING RISE TO THE CLAIM AND (b) US$100. 19.3. EACH PROVISION OF THESE TERMS THAT PROVIDES FOR A LIMITATION OF LIABILITY, DISCLAIMER OF WARRANTIES, OR EXCLUSION OF DAMAGES IS INTENDED TO AND DOES ALLOCATE THE RISKS BETWEEN THE PARTIES UNDER THESE TERMS. THIS ALLOCATION IS AN ESSENTIAL ELEMENT OF THE BASIS OF THE BARGAIN BETWEEN THE PARTIES. EACH OF THESE PROVISIONS IS SEVERABLE AND INDEPENDENT OF ALL OTHER PROVISIONS OF THESE TERMS. THE LIMITATIONS IN THIS SECTION 19 WILL APPLY EVEN IF ANY LIMITED REMEDY FAILS OF ITS ESSENTIAL PURPOSE."
This segment limits Exafunction's liability to the fullest extent permitted by law, excluding indirect, incidental, special, consequential, and punitive damages arising from use or inability to use the Service, regardless of legal theory or prior notice of the possibility of such damages.
AI-generated interpretation, not legal advice.
"EXCEPT AS PROVIDED IN SECTIONS 20.5 AND 20.6 AND TO THE FULLEST EXTENT PERMITTED BY LAW, THE AGGREGATE LIABILITY OF THE EXAFUNCTION ENTITIES TO YOU FOR ALL CLAIMS ARISING OUT OF OR RELATING TO THE USE OF OR ANY INABILITY TO USE ANY PORTION OF THE SERVICE OR OTHERWISE UNDER THESE TERMS, WHETHER IN CONTRACT, TORT, OR OTHERWISE, IS LIMITED TO THE GREATER OF: (a) THE AMOUNT YOU HAVE PAID TO EXAFUNCTION FOR ACCESS TO AND USE OF THE SERVICE IN THE 12 MONTHS PRIOR TO THE EVENT OR CIRCUMSTANCE GIVING RISE TO THE CLAIM AND (b) US$100."
The aggregate cap limits total recoverable damages to the lesser of prior 12-month payments or $100. This is a standard SaaS liability cap but the $100 minimum floor is very low. For free-tier users, recovery could be limited to $100 regardless of the harm suffered.
AI-generated interpretation, not legal advice.
"THE SERVICE AND ALL MATERIALS AND CONTENT AVAILABLE THROUGH THE SERVICE, INCLUDING SUGGESTIONS, ARE PROVIDED "AS IS" AND ON AN "AS AVAILABLE" BASIS. EXAFUNCTION DISCLAIMS ALL WARRANTIES OF ANY KIND, WHETHER EXPRESS OR IMPLIED, RELATING TO THE SERVICE AND ALL MATERIALS AND CONTENT AVAILABLE THROUGH THE SERVICE, INCLUDING: (a) ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, QUIET ENJOYMENT, OR NON-INFRINGEMENT; AND (b) ANY WARRANTY ARISING OUT OF COURSE OF DEALING, USAGE, OR TRADE. EXAFUNCTION DOES NOT WARRANT THAT THE SERVICE OR ANY PORTION OF THE SERVICE, OR ANY MATERIALS OR CONTENT OFFERED THROUGH THE SERVICE, INCLUDING SUGGESTIONS, WILL BE UNINTERRUPTED, SECURE, OR FREE OF ERRORS, VIRUSES, OR OTHER HARMFUL COMPONENTS, AND EXAFUNCTION DOES NOT WARRANT THAT ANY OF THOSE ISSUES WILL BE CORRECTED."
The as-is / as-available disclaimer eliminates all express and implied warranties, including fitness for purpose and non-infringement, across all service outputs including AI suggestions. This places all risk of defective or harmful outputs on the user.
AI-generated interpretation, not legal advice.
"By enabling a Third-Party Platform to interact with the Service, you permit the Service to exchange User Content with such Third-Party Platform."
This clause broadly permits User Content to flow to third-party platforms upon integration. The lack of specificity about what data is exchanged and absence of safeguards creates data exposure risk, especially for sensitive code or business logic.
AI-generated interpretation, not legal advice.
Common questions about Windsurf (Codeium)'s policies
- Does Windsurf (Codeium) train its AI models on your data?
- Training possible — conditions or opt-outs apply — based on 4 verified findings from Windsurf (Codeium)'s published policy. Informational only, not legal advice.
Clause detail — protections, your obligations, and coverage
Every clause below is a verbatim quote from Windsurf (Codeium)'s own published policy, read in full and linked to its exact location. Protections and user obligations are reported separately from risk because they are different kinds of clause — an obligation on you is not a risk to your data. Informational only, not legal advice.
✅ Protections found
9 verified clausesClauses in Windsurf (Codeium)'s policies that work in your favour — commitments the platform made to you.
- Model trainingdoes-not-train
“11. Usage and User Content. Exafunction may collect, generate, and derive Usage Data for Exafunction's lawful business purposes, including to: (1) monitor, operate, improve, and support the Service and its performance, security, and stability; (2) create analy…”
Grants Exafunction the right to collect, generate, and derive Usage Data for business purposes including service improvement and product development, asserts Exafunction's ownership of all intellectual property in Usage…
📍 § 10.2Jump to exact text → - Subprocessors & data sharingsale/sharing of personal data
“We do not sell or share your personal information with third parties for targeted advertising purposes, nor have we done so in the past 12 months. We also do not have actual knowledge that we sell or share for targeted advertising purposes personal information…”
Restricts selling or sharing personal information for targeted advertising and prohibits such practices for users under 16; also discloses that service providers receive personal data as necessary to provide the Services…
📍 § 3 (How and why we share your information)Jump to exact text → - Moderation & enforcementterms can change anytime
“5.1. Price. Exafunction reserves the right to determine pricing for the Service. Exafunction will make reasonable efforts to keep pricing information published on the Service up to date. We encourage you to check our pricing page periodically for current prici…”
Grants Exafunction the right to set, change, and make promotional pricing for the Service, while imposing a notice obligation before fee changes apply, and distinguishes pricing across different customer tiers.
- Terms changes: advance notice promised
📍 § 5.1Jump to exact text → - Privacy & data use
“Right to withdraw your consent : To the extent processing of your personal information is based on your consent, you may withdraw your consent at any time. The lawfulness of our processing before you withdraw your consent will not be affected by such withdrawa…”
Specifies additional user rights including consent withdrawal, right to appeal denials of privacy requests, and right to lodge complaints with data protection authorities, and establishes the procedure for submitting req…
- Designated security contact: privacy@cognition.ai
📍 § 8 (Your privacy rights and choices)Jump to exact text → - Prompt ownership
“9.1. User Content Generally. Certain features of the Service may permit users to submit, upload, publish, broadcast, or otherwise transmit ("Post") content to the Service, including folders, data, text, and any other works of authorship or other works ("User C…”
Confirms users retain copyright and proprietary rights in User Content they post, defines 'Post' and 'User Content', and grants Exafunction authorization to use User Content to provide the Service and Suggestions, establ…
📍 § 9.1Jump to exact text → - Audit rights, DPA & residency
“To facilitate our operations, Cognition, our third-party partners, and service providers may transfer, store, and process your personal information throughout the world, including the EU, UK and the US. If you reside in the EEA, Switzerland, or the United King…”
Global data transfers are authorized without enumeration of specific countries. SCCs and UK IDTA are referenced for EEA/UK users but no audit rights, DPA offering, or data residency commitments are described. Enterprise…
📍 § 7 (International transfers)Jump to exact text →
+ 3 more verified clauses of this kind on this platform, cited in full in the report.
📋 Rules you must follow
6 verified clausesWhat Windsurf (Codeium) requires of YOU. These are your obligations, not risks to your data or IP, so they are cited here and excluded from this platform's risk rating.
- Moderation & enforcement
“use the Service for any illegal purpose or in violation of any local, state, national, or international law; harass, threaten, demean, embarrass, bully, or otherwise harm any other user of the Service; violate, encourage others to violate, or provide instruc…”
Enumerates specific prohibited conducts including illegal use, harassment, IP infringement, unauthorized automated access, and other harmful activities, creating enforceable restrictions on user behavior.
📍 § 10.2Jump to exact text → - Moderation & enforcement
“You agree to comply with all applicable Trade Controls in using any Service and Suggestions. Specifically, you represent and warrant that you will not export, re-export, or transfer (in-country) to or otherwise allow the use of the Service, Suggestions, or ite…”
This segment imposes an obligation on users to comply with all applicable trade control laws and restrictions, and prohibits export, re-export, or transfer of the Service or its outputs to restricted persons or entities,…
📍 § 21.11Jump to exact text → - Moderation & enforcementconduct restrictions
“7. Ownership; Proprietary Rights. The Service is owned and operated by Exafunction. The visual interfaces, graphics, design, compilation, information, data, computer code (including source code or object code), products, software, services, and all other eleme…”
Asserts Exafunction's ownership of all Service materials and intellectual property, prohibits unauthorized use of Materials, and confirms no implied licenses are granted, establishing the company's proprietary rights ove…
📍 § 6.3Jump to exact text → - Moderation & enforcementconduct restrictions
“Section 7) or any right or ability to view, access, or use any Materials; or attempt to do any of the acts described in this Section 13 or assist or permit any person in engaging in any of the acts described in this Section 13.”
Extends prohibited conduct restrictions to include attempts to perform prohibited acts and assisting others in doing so, reinforcing the enforcement scope of the prohibited conduct section.
📍 § 10.2Jump to exact text → - Moderation & enforcement
“information in your notice is accurate and that, under penalty of perjury, you are the copyright or other intellectual property right owner or authorized to act on the copyright or intellectual property owner's behalf.”
Imposes an obligation on complainants to certify the accuracy of their notice and sign under penalty of perjury, establishing a legal accountability requirement for DMCA notification accuracy.
📍 § 14.3Jump to exact text →
+ 1 more verified clause of this kind on this platform, cited in full in the report.
What the policies actually cover
16 topics- Product telemetry & usage tracking2 clauses
- Advertising & tracking1 clause
- Sale or sharing of personal data1 protective1 clause
- Government & law-enforcement disclosure2 clauses
- Does not train on your content1 protective1 clause
- Trains by default, opt-out available2 clauses
- Arbitration & class-action waiver3 clauses
- Damages & liability cap8 clauses
- Indemnity direction3 clauses
- Terms can change at any time3 protective3 clauses
- Deletion rights & post-termination survival4 clauses
- Auto-renewal & cancel window1 clause
- Feedback ownership1 clause
- Human review of your content1 clause
- Breach-notification promises1 clause
- Conduct restrictions2 obligations2 clauses
32 further verified clauses are cited on this page but not yet assigned a topic.
Cross-clause notes
Two verified clauses intersect on the same subject matter: the Privacy Policy, § 5 (Retention) addresses how long content is retained, and the Terms of Service, § 10.1 addresses use of content in connection with model training or service improvement. Both clauses are in force at the same time — read them together.
The Terms of Service, § 10.1 describes a way to decline model training, and the Terms of Service, Terms of Service › “Terms of Service: Individual & Pro” states that terms differ by plan or tier. Whether the opt-out applies on every tier is determined by those clauses together — read both before relying on the opt-out.
Automated cross-reference against the published rubric — not legal advice.
Clause intelligence
Canonical clauses and stance patterns extracted from the same gate-verified citations shown on this page.
The clause allows indefinite, perpetual, or necessity-based retention.
“You should retain copies of any User Content you Post to the Service so that you have permanent copies in the event the Service is modified in such a way that you lose access to User Content you Posted to the Service.”Open source citation
The clause imposes arbitration, class-action waiver, or jury-trial waiver terms.
“16.1. Term. These Terms are effective beginning when you accept the Terms or first download, install, access, or use the Service, and ending when terminated as described in Section 16.2. 16.2. Termination. If you violate any provision of these Terms, then your authorization to access the Service and these Terms automatically terminate. In addition, Exafunction may, at its sole discretion, terminate these Terms or ...”Open source citation
The clause imposes arbitration, class-action waiver, or jury-trial waiver terms.
“20. Dispute Resolution and Arbitration.”Open source citation
The clause imposes arbitration, class-action waiver, or jury-trial waiver terms.
“Further, unless both you and Exafunction agree otherwise, the arbitrator may not consolidate more than one person's claims, and may not otherwise preside over any form of a representative or class proceeding. 20.9. Modifications to this Arbitration Provision. If Exafunction makes any substantive change to this arbitration provision, you may reject the change by sending us written notice within 30 days of the ...”Open source citation
The clause imposes arbitration, class-action waiver, or jury-trial waiver terms.
“20.1. Generally. Except as described in Section 20.2 and 20.3, you and Exafunction agree that every dispute arising in connection with these Terms, the Service, or communications from us will be resolved through binding arbitration. Arbitration uses a neutral arbitrator instead of a judge or jury, is less formal than a court proceeding, may allow for more limited discovery than in court, and is subject to very lim...”Open source citation
Tier matrix
Plan-level conditions detected from citation-backed clauses. Empty tiers mean AIRIN has not captured decisive tier language yet.
| Tier | Surface | Verdict | Risk | Citations |
|---|---|---|---|---|
| All applicable tiers | data retention | conditional | MEDIUM | 1 |
| All applicable tiers | governing law disputes | conditional | MEDIUM | 8 |
| All applicable tiers | indemnity liability | worsens | HIGH | 12 |
| All applicable tiers | moderation enforcement | worsens | HIGH | 3 |
| All applicable tiers | prompt ownership | improves | LOW | 2 |
| All applicable tiers | subprocessors data sharing | conditional | MEDIUM | 2 |
| Free | indemnity liability | conditional | MEDIUM | 2 |
| Free | training use | worsens | HIGH | 3 |
| Pro / Paid | commercial use | worsens | HIGH | 4 |
| Pro / Paid | governing law disputes | conditional | MEDIUM | 1 |
| Pro / Paid | indemnity liability | conditional | MEDIUM | 1 |
| Pro / Paid | privacy data use | worsens | HIGH | 1 |
Policy evolution
Open full timelineBefore/after stance changes across captured policy versions. When no material delta exists yet, AIRIN shows the latest citation-backed stance events instead.
model training improved from high/training permitted to medium/training with opt out.
“If you choose to provide input and suggestions regarding existing functionalities, problems with or proposed modifications or improvements to the Service ("Feedback"), then you hereby grant Exafunction an unrestricted, perpetual, irrevocable, non-exclusive, fully-paid, royalty-free right and license to exploit the Feedback in any manner and for any purpose, including to improve the Service and create other products and services.”Before citation
“3.3 Data Usage and Rights: 3.3.1 Use of Customer Data: Cognition may use Customer Data for model training purposes and to improve and enhance the Services. If you subscribe to a paid Service Tier, you may opt out of this use (“Opt-Out”). Following an Opt-Out election: (A) Customer Data will not be used for any other purpose, including training language models; and (B) Zero Data Retention will be enabled with our model providers. For the Teams Service Tier, only an administrator may exercise the Opt-Out. 3.3.2 Usage Data: Cognition reserves the right to collect, analyze, and utilize Usage Data for operational, analytical, and improvement purposes. Cognition owns all right, title, and interest in and to the Usage Data. 3.3.3 Abuse and Legal Process: ZDR does not preclude retention or disclosure of Customer Data (i) flagged on automated safety and abuse-detection classifiers; (ii) to perform safety, security, and AUP compliance review; or (iii) as compelled by applicable law or legal process. 3.4 Marketing: Subject to your prior consent, Cognition may use your name, logo, and trademarks in publicity, including, but not limited to, displaying your name, logo, or trademark on Cognition's website and marketing materials. Additionally, you agree to consider in good faith participating in a written case study at Cognition's request, detailing the collaboration and outcomes of the project, subject to mutual agreement on the content and timeline.”After citation
legal burden changed from medium/liability limited to medium/indemnity.
“THE SERVICE AND ALL MATERIALS AND CONTENT AVAILABLE THROUGH THE SERVICE, INCLUDING SUGGESTIONS, ARE PROVIDED "AS IS" AND ON AN "AS AVAILABLE" BASIS. EXAFUNCTION DISCLAIMS ALL WARRANTIES OF ANY KIND, WHETHER EXPRESS OR IMPLIED, RELATING TO THE SERVICE AND ALL MATERIALS AND CONTENT AVAILABLE THROUGH THE SERVICE, INCLUDING: (a) ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, QUIET ENJOYMENT, OR NON-INFRINGEMENT; AND (b) ANY WARRANTY ARISING OUT OF COURSE OF DEALING, USAGE, OR TRADE. EXAFUNCTION DOES NOT WARRANT THAT THE SERVICE OR ANY PORTION OF THE SERVICE, OR ANY MATERIALS OR CONTENT OFFERED THROUGH THE SERVICE, INCLUDING SUGGESTIONS, WILL BE UNINTERRUPTED, SECURE, OR FREE OF ERRORS, VIRUSES, OR OTHER HARMFUL COMPONENTS, AND EXAFUNCTION DOES NOT WARRANT THAT ANY OF THOSE ISSUES WILL BE CORRECTED.”Before citation
“consents to such settlement, and provided, further, that Cognition will have the right, at its option, to defend itself against any such Third-Party Claim or to participate in the defense thereof by counsel of its own choice.”After citation
content license worsened from medium/broad license to high/sublicensable or transferable.
“If you choose to provide input and suggestions regarding existing functionalities, problems with or proposed modifications or improvements to the Service ("Feedback"), then you hereby grant Exafunction an unrestricted, perpetual, irrevocable, non-exclusive, fully-paid, royalty-free right and license to exploit the Feedback in any manner and for any purpose, including to improve the Service and create other products and services.”Before citation
“3.1 Ownership: Cognition owns all right, title, and interest, including all intellectual property rights, in and to the Services, Documentation, and Cognition IP, and reserves all rights not expressly granted to you in this Agreement. Cognition assigns to you all right, title, and interest in Output. You own all right, title, and interest, including all intellectual property rights, in and to Customer Data, including Outputs to the fullest extent permitted by applicable law. You acknowledge that Outputs are generated automatically by machine learning technology and may be similar to or the same as Outputs provided to other customers; no rights to any Outputs generated for or provided to other customers are granted to you under these Terms. 3.2 License: By using the Services, you hereby grant to Cognition, its affiliates, successors, and assigns a non-exclusive, worldwide, royalty-free, fully paid, sublicensable (solely for the purposes of providing the Services to you), transferable license to reproduce, distribute, modify, and otherwise use, display, and perform all acts with respect to the Customer Data as may be necessary for Cognition to provide the Services to you. You hereby represent and warrant that: (i) you have all necessary rights to grant Cognition the license set forth in this section, and to allow Cognition to exercise its rights under such license without infringement of the rights of any third party, including privacy rights; and (ii) Cognition's receipt and processing of Customer Data in accordance with this Agreement does not and will not violate any applicable laws or regulations.”After citation
data sharing improved from high/sale or sell to medium/third party or vendor sharing.
“Your employer or related organisation — If you create an account using an email address belonging or relating to your employer or another organisation, we may share the fact that you have an account and certain account information (such as your email address) with your employer or organisation to, for example, enable you to be added to their business or enterprise account. In addition, administrators of any enterprise or business account may be able to access certain information associated with your account, including your User Content, and be able to control your account and such information. To our affiliates or others within our corporate group , as a matter of our legitimate interests to efficiently provide the Services. Asset Transfer or Company Acquisition — We may choose to buy or sell assets, and may share and/or transfer information about our users in connection with the evaluation of and entry into such transactions. Also, if we (or our assets) are acquired, merged, reorganized, or if we go out of business, enter bankruptcy, or go through some other change of control or similar event, your personal information could be transferred in connection with that transaction. When you request or direct us to disclose information , with your consent or to perform our contract with you. Our Services may contain links to other websites not operated or controlled by Cognition AI, Inc, including social media services (“Third-Party Sites”).”Before citation
“The information that you share with Third Party Sites will be governed by the specific privacy policies and terms of service of the Third Party Sites and not by this Privacy Policy. By providing these links we do not imply that we endorse or have reviewed these sites. Please contact the Third Party Sites directly for information on their privacy practices and policies.”After citation
data sharing worsened from medium/third party or vendor sharing to high/sale or sell.
“Depending on where you live, you may be able to exercise certain privacy rights related to your personal information. If any of the rights listed below are not provided for under law for your jurisdiction, we have absolute discretion in providing these rights. Right to access/know and portability : You may have the right to request that we provide you a copy of your personal information held by us, or for details relating to the ways in which we use and disclose your personal information, and how we have used or disclosed your personal information in the past. You may also have the right to request that we provide certain personal information in a structured, commonly used, machine-readable format and make this available to you or a designated third party. Right to deletion/erasure : You may have the right to request to erase your personal information. If you end your Services, we will retain or delete information associated with your account as described in Section 5. Right to rectification/correction : You may have the right to request us to rectify or update any of your personal information that is incomplete or inaccurate. Right to object or restrict processing : You may have the right to restrict or object to us using or transferring your personal information based on our legitimate interests, in the public interest or for direct marketing. We may continue to process your personal information where permitted or required by applicable law.”Before citation
“Your employer or related organisation — If you create an account using an email address belonging or relating to your employer or another organisation, we may share the fact that you have an account and certain account information (such as your email address) with your employer or organisation to, for example, enable you to be added to their business or enterprise account. In addition, administrators of any enterprise or business account may be able to access certain information associated with your account, including your User Content, and be able to control your account and such information. To our affiliates or others within our corporate group , as a matter of our legitimate interests to efficiently provide the Services. Asset Transfer or Company Acquisition — We may choose to buy or sell assets, and may share and/or transfer information about our users in connection with the evaluation of and entry into such transactions. Also, if we (or our assets) are acquired, merged, reorganized, or if we go out of business, enter bankruptcy, or go through some other change of control or similar event, your personal information could be transferred in connection with that transaction. When you request or direct us to disclose information , with your consent or to perform our contract with you. Our Services may contain links to other websites not operated or controlled by Cognition AI, Inc, including social media services (“Third-Party Sites”).”After citation
Latest stance: sublicensable or transferable on training use
“3.1 Ownership: Cognition owns all right, title, and interest, including all intellectual property rights, in and to the Services, Documentation, and Cognition IP, and reserves all rights not expressly granted to you in this Agreement. Cognition assigns to you all right, title, and interest in Output. You own all right, title, and interest, including all intellectual property rights, in and to Customer Data, including Outputs to the fullest extent permitted by applicable law. You acknowledge that Outputs are generated automatically by machine learning technology and may be similar to or the same as Outputs provided to other customers; no rights to any Outputs generated for or provided to other customers are granted to you under these Terms. 3.2 License: By using the Services, you hereby grant to Cognition, its affiliates, successors, and assigns a non-exclusive, worldwide, royalty-free, fully paid, sublicensable (solely for the purposes of providing the Services to you), transferable license to reproduce, distribute, modify, and otherwise use, display, and perform all acts with respect to the Customer Data as may be necessary for Cognition to provide the Services to you. You hereby represent and warrant that: (i) you have all necessary rights to grant Cognition the license set forth in this section, and to allow Cognition to exercise its rights under such license without infringement of the rights of any third party, including privacy rights; and (ii) Cognition's receipt and processing of Customer Data in accordance with this Agreement does not and will not violate any applicable laws or regulations.”Open timeline citation
Latest stance: broad license on training use
“3.1 Ownership: Cognition owns all right, title, and interest, including all intellectual property rights, in and to the Services, Documentation, and Cognition IP, and reserves all rights not expressly granted to you in this Agreement. Cognition assigns to you all right, title, and interest in Output. You own all right, title, and interest, including all intellectual property rights, in and to Customer Data, including Outputs to the fullest extent permitted by applicable law. You acknowledge that Outputs are generated automatically by machine learning technology and may be similar to or the same as Outputs provided to other customers; no rights to any Outputs generated for or provided to other customers are granted to you under these Terms. 3.2 License: By using the Services, you hereby grant to Cognition, its affiliates, successors, and assigns a non-exclusive, worldwide, royalty-free, fully paid, sublicensable (solely for the purposes of providing the Services to you), transferable license to reproduce, distribute, modify, and otherwise use, display, and perform all acts with respect to the Customer Data as may be necessary for Cognition to provide the Services to you. You hereby represent and warrant that: (i) you have all necessary rights to grant Cognition the license set forth in this section, and to allow Cognition to exercise its rights under such license without infringement of the rights of any third party, including privacy rights; and (ii) Cognition's receipt and processing of Customer Data in accordance with this Agreement does not and will not violate any applicable laws or regulations.”Open timeline citation
Latest stance: sublicensable or transferable on confidentiality
“2.1 Rights Granted: Subject to your compliance with the terms and conditions of this Agreement, Cognition hereby grants you a non-exclusive, non-sublicensable, non-transferable right to access and use the Services and Documentation for your internal business purposes only, solely for use by you and your Authorized Users during the Term. Cognition reserves all rights not expressly granted to you in and to the Services, Documentation, and Cognition IP. 2.2 Your responsibilities: You and your Authorized Users may be asked to create a user account to access the Services and Documentation. You are responsible for all uses of the Services and Documentation that result from your access or use, directly or indirectly, whether such access or use is permitted by or is in violation of this Agreement. Without limiting the generality of the foregoing, you are responsible for (i) all acts and omissions of Authorized Users, and for any act or omission by an Authorized User that would constitute a breach of this Agreement if taken by you; and (ii) safeguarding the confidentiality of all passwords and usernames associated with your account and your Authorized Users' accounts, and for any use or misuse of the Services by anyone using such passwords or usernames, whether or not authorized by you. You agree to use all reasonable efforts to make all Authorized Users aware of the provisions of this Agreement that are applicable to such Authorized User's use of the Services, and will cause Authorized Users to comply with such provisions.”Open timeline citation
Latest stance: no training claim on training use
“2.3 Restrictions: You may not use the Services for any purposes beyond the scope of the access granted in this Agreement. You may not, at any time, directly or indirectly, and must ensure that your Authorized Users do not: (i) copy, reproduce, modify, translate, or create derivative works of the Services or Documentation, in whole or in part; (ii) reverse engineer, disassemble, decompile, decode, adapt, or otherwise attempt to derive or gain access to any software component of the Services, in whole or in part; (iii) use the Services to create or develop any competing products or services, including to train competing artificial intelligence models except as expressly approved by Cognition in writing; or (iv) make the Services or Documentation available to anyone other than Authorized Users (collectively, “Use Restrictions”). 2.4 Suspension: We reserve the right to temporarily suspend your access and any Authorized User's access to any portion or all of the Services if, in our sole discretion, we reasonably determine that: (i) there is a threat or attack on any Cognition IP; (ii) your use or any of your Authorized User's use of the Cognition IP disrupts or poses a security risk to Cognition IP or to any other Cognition customer or vendor; (iii) you or your Authorized Users are using the Cognition IP for fraudulent or illegal activities; (iv) your actions risk harm to any of our other customers or the security, availability, or integrity of the Services; or (v) you have ceased to continue business in the ordinary course, made an assignment for the benefit of creditors or similar disposition of its assets, or become the subject of any bankruptcy, reorganization, liquidation, dissolution, or similar proceeding.”Open timeline citation
Capture recency
- Privacy Policy:Last captured 2026-07-03· verified 2026-07-03
- Terms of Service:Last captured 2026-07-03· verified 2026-07-03
Dates state when our pipeline captured and verified each document — not when the vendor last changed it. Documents are re-scanned on a recurring cadence; a document verified once says so until a re-scan confirms it again.
↓ 76 fewer findings this quarter vs last (43 vs 119). First scan: June 2026.
Compare and stack are saved in your browser. Open compare · View your stack. A correction triggers an automated re-read of Windsurf (Codeium)'s policies — no human edits the data.
Need this for procurement or legal diligence?
Free shows today's risk. A Stack Audit gives you a citable, verbatim-sourced PDF across your whole AI stack — and flags the moment a vendor's terms change.
Every finding above is a verbatim quote from Windsurf (Codeium)'s own published policy, captured to an immutable snapshot and read in full through a two-gate verification pipeline. Confidence labels and any analysis are AI-generated and informational only — not legal advice.
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.