Is Qoder Safe? 7 Proven Facts About What Alibaba Does With Your Code

Is Qoder Safe? Qoder documents meaningful privacy and security controls, but its public documentation does not support the stronger claim that no user code or User Content ever leaves your machine. Qoder’s FAQ says code context used for code completion is not stored or shared, while its May 12, 2026 Privacy Policy defines code, chats, and agent interactions as “User Content” and states that User Content is used to provide the service. The same policy also says de-identified User Content may be used to research, develop, and improve the service for up to five years, subject to plan-specific controls such as “Share & Improve.”

That distinction matters. If you are evaluating Qoder for a private repository, the right question is not simply whether Qoder is “safe.” The useful questions are: what data does Qoder receive, why does it receive it, which providers can process it, how long can it be retained, and what controls can you turn off?

This article reflects publicly available Qoder documentation and privacy terms as of August 31, 2026. It is research-based, not a hands-on security audit. For a privacy-first alternative that runs entirely on your machine, see CodAI Offline.

Table of Contents

• What Qoder Says About Your Code
• What the Privacy Policy Adds
• Does Alibaba See Your Code?
• What Qoder Can Retain
• What Qoder Shares With Service Providers
• Qoder’s Security Controls
• The Main Privacy Risk for Developers
• How to Use Qoder More Safely
• Verdict: Is Qoder Safe?
• FAQ

What Qoder Says About Your Code

Qoder’s public FAQ makes a strong statement about code completion: the product needs code context to generate suggestions, but that context is not stored or used for other purposes. Qoder also says code snippets are not shared with other users. (Source: Qoder FAQ)

That is reassuring, but it describes a particular data flow rather than every possible Qoder workflow.

Qoder is now more than a simple autocomplete tool. Its documentation describes an agentic coding environment that can work with local code, external services, web content, remote connections, and MCP integrations. Qoder CLI documentation says its tools can search and read project content, modify files, run commands, fetch web content, and connect to external services through MCP. (Source: Qoder Security and Authorization; Qoder CLI Tools)

The practical result is important: the privacy implications depend on which Qoder feature you use and what context you give the agent.

A completion request involving a small local code window is not the same privacy scenario as an agent task that reads a repository, calls an external service, searches the web, or uses a connected model provider.

What the Privacy Policy Adds

Qoder’s Privacy Policy was last updated on May 12, 2026. It applies to Qoder IDE, the website, software, and related services. The policy is issued by BRIGHT ZENITH PRIVATE LIMITED, a Singapore-registered entity. (Source: Qoder Privacy Policy)

The policy defines “User Content” broadly. It includes interactions such as chats, programming sessions, and agentic sessions, along with the resulting outputs. If you put personal data into an input, Qoder says it collects that information and it may appear in generated output. (Source: Qoder Privacy Policy)

This is the most important qualification to the simple “Qoder does not store your code” message.

The FAQ is specifically talking about code context used for code completion. The privacy policy covers the broader service and says User Content is involved in providing core and optional features. In other words, developers should not interpret the autocomplete FAQ as a blanket promise that every piece of content sent through every Qoder feature is permanently ephemeral.

What the policy says about improvement

Qoder says it takes steps to remove personal data from User Content, where legally permitted, before using it to research, develop, and improve its services.

It also says that, depending on the plan, users may opt out by disabling the “Share & Improve” setting. Qoder states that data already processed before the setting was disabled may continue to be retained and used. (Source: Qoder Privacy Policy)

The policy lists de-identified User Content used for research, development, and service improvement with a retention period of up to five years. That is a materially different statement from “nothing is ever retained,” and it should be part of any enterprise privacy review. (Source: Qoder Privacy Policy)

Does Alibaba See Your Code?

This is where the article title needs a precise answer.

Qoder’s public privacy policy says it may share personal data with service providers, including large language model providers such as Alibaba’s Qwen and Moonshot’s Kimi, to support the coding experience and generate outputs. It also lists cloud infrastructure, codebase data storage, and web-search providers as categories of service providers. (Source: Qoder Privacy Policy)

So the accurate answer is not “Alibaba never receives anything.”

At the same time, the public policy does not establish that Alibaba receives every file in every Qoder session, nor does it say that Alibaba gets unrestricted access to your entire repository. The policy describes sharing in the context of providing the service and says service providers are contractually required to meet applicable data-protection standards. (Source: Qoder Privacy Policy)

Therefore:

Needs verification: Qoder’s public documentation does not provide enough detail to map every type of code context to every underlying model provider for every Qoder workflow.

That is the key unresolved question for teams handling highly confidential source code.

Also, “Alibaba” should not be treated as a synonym for Qoder’s legal operator. Qoder’s current global privacy policy identifies BRIGHT ZENITH PRIVATE LIMITED as the entity responsible for the service, while naming Alibaba’s Qwen among possible model service providers. (Source: Qoder Privacy Policy)

What Qoder Can Retain

Qoder’s privacy policy provides different retention rules for different categories of information.

Account information can be retained for as long as the account exists. Information used for service operation, debugging, support, security, and some other purposes can also be retained according to the policy’s stated purposes and legal requirements. (Source: Qoder Privacy Policy)

For research, development, and service improvement, the policy specifies de-identified User Content and says it can be retained for up to five years. Users may have a “Share & Improve” opt-out depending on their plan. (Source: Qoder Privacy Policy)

Qoder’s CLI documentation also exposes session-retention settings. The documented defaults include automatic session cleanup enabled, with a maximum session age of 30 days and a minimum retention period of 1 day. These are CLI session settings and should not be confused with the separate retention terms in the company’s privacy policy. (Source: Qoder CLI Settings Reference)

This distinction is useful because there are at least two different questions:

1. How long does a local Qoder session remain available?
2. How long can service-side data be retained under the privacy policy?

The public documentation does not suggest that the local CLI cleanup setting overrides all service-side retention obligations.

What Qoder Shares With Service Providers

Qoder’s policy names several categories of service providers that may process information:

• Cloud infrastructure providers that host the service
• Large language model providers, including Alibaba’s Qwen and Moonshot’s Kimi
• Codebase data storage providers
• Web-search providers
• Other providers needed to operate the service

Qoder says these providers are contractually required to maintain data-protection standards equal to or higher than those required by applicable law. (Source: Qoder Privacy Policy)

The policy also says that when users enable BYOK (Bring Your Own Key), information may be transmitted to the third-party provider selected by the user. In that case, the third party’s own privacy policy applies to that processing. (Source: Qoder Privacy Policy)

For organizations, Qoder says personal data may also be shared with the organization, administrators, and potentially other users within the organization under Enterprise or Team plans. (Source: Qoder Privacy Policy)

Qoder’s Security Controls

Qoder documents several security features that reduce operational risk, although these should not be confused with privacy guarantees.

Its code-security system includes three progressive scans:

• Static Check for high-risk patterns while code is being written
• Lightweight Scan for semantic risks near task completion
• Deep Scan for cross-file and cross-function data-flow risks before important changes are committed or pushed

Qoder says these scans can identify issues such as SQL injection, remote command execution, and sensitive-information leakage. It also explicitly says security scanning does not replace testing, dependency auditing, secret management, or human review. (Source: Qoder Code Security documentation)

Qoder’s security guidance also tells users not to paste passwords, API keys, access tokens, private keys, or production connection strings into task instructions. That is good practice for any AI coding agent. (Source: Qoder Security and Authorization)

Qoder also documents runtime risks for agentic systems, including prompt injection, sensitive-data leakage, and malicious command execution. Alibaba Cloud documentation describes an AI Guardrails approach for Qoder-series agents that can detect and block potential threats at user-input and model-output stages. (Source: Alibaba Cloud Qoder runtime security documentation)

The Main Privacy Risk for Developers

The biggest mistake is to think of Qoder as ordinary autocomplete.

An agentic coding tool can receive enough repository context to understand a task, inspect files, execute commands, and interact with connected services. Qoder’s own CLI documentation confirms that its tools can read project content, modify files, run commands, fetch web content, and use MCP-connected services. (Source: Qoder CLI Tools)

That creates a larger trust boundary.

If your repository contains proprietary algorithms, customer data, credentials, private certificates, internal URLs, or regulated information, you should assume that putting that material into an AI agent’s working context is a security decision.

Qoder’s documentation itself recommends keeping credentials out of tasks. (Source: Qoder Security and Authorization)

A safe operating policy is therefore stricter than “Qoder does not store autocomplete context.”

How to Use Qoder More Safely

If you want to use Qoder with private code, these steps reduce exposure:

1. Do not place secrets in prompts

Never paste API keys, passwords, access tokens, private keys, or production database credentials into Qoder tasks. Qoder explicitly recommends this. (Source: Qoder Security and Authorization)

2. Review the “Share & Improve” setting

If your plan exposes the setting, check whether Share & Improve is enabled. Qoder says disabling it prevents User Content from being used for the described research, development, and improvement purposes, although previously processed data may remain subject to the policy. (Source: Qoder Privacy Policy)

3. Limit repository scope

Give the agent access to only the files required for the task. Avoid pointing an agent at unrelated repositories, secrets directories, production configuration, or customer exports.

4. Treat MCP and external tools as separate trust boundaries

Qoder can connect to external services through MCP. Review each connected service and its own data-handling terms before enabling it for a sensitive project. (Source: Qoder CLI Tools)

5. Use organization controls where available

Enterprise and Team environments have organization-level features and administrator involvement. For a company, review the actual plan terms, data-processing arrangements, retention settings, and provider configuration before approving Qoder for sensitive repositories.

6. Keep high-risk code out until the data flow is verified

If your company cannot establish where confidential source code is processed, which providers can receive it, and how long it can remain available, do not put your most sensitive repositories into the workflow yet.

Verdict: Is Qoder Safe?

Is Qoder Safe? Yes, for many individual and development workflows, Qoder has documented privacy and security controls that make it a reasonable AI coding tool. But it is not accurate to describe Qoder as a system where no code-related data can ever leave your machine or be retained.

The strongest evidence is the combination of Qoder’s FAQ and its broader privacy policy.

The FAQ says code-completion context is not stored or shared. The privacy policy, however, treats broader chats, programming sessions, and agentic sessions as User Content, permits processing by service providers including model providers such as Alibaba’s Qwen and Moonshot’s Kimi, and allows de-identified User Content to be used for service improvement for up to five years, depending on the applicable settings and terms. (Source: Qoder FAQ; Qoder Privacy Policy)

For normal personal projects, that may be an acceptable trade-off.

For proprietary enterprise code, the answer should be “safe only after your organization’s data-flow and contractual review.”

The most important unanswered question is not whether Qoder is owned by or associated with Alibaba. It is which specific code context is sent to which provider under each Qoder feature, and under what retention rules.

Research verdict: Qoder is not a red-flag product based on its published documentation, but developers should not assume that every agent interaction has the same privacy treatment as code completion.

If you prefer an AI coding tool that never sends code off your machine, see how CodAI Offline handles code privacy and read our guide to running AI models locally in your browser without cloud dependency.

FAQ

Does Qoder store my code?

Qoder says code context used for code completion is not stored or used for other purposes. However, Qoder’s broader privacy policy defines chats, programming sessions, and agentic sessions as User Content and describes how User Content is processed for service delivery and other permitted purposes. (Source: Qoder FAQ; Qoder Privacy Policy)

Does Qoder send code to Alibaba?

Qoder’s privacy policy says it may share personal data with service providers including Alibaba’s Qwen model service for coding and output generation. The public documentation does not establish that every Qoder workflow sends an entire repository to Alibaba. (Source: Qoder Privacy Policy)

Does Qoder use my code to train AI?

Qoder says de-identified User Content may be used to research, develop, and improve its services, with retention of up to five years. Depending on the plan, users can opt out through the “Share & Improve” setting. The public policy does not describe this simply as a universal “training on your code” program. (Source: Qoder Privacy Policy)

Is Qoder safe for proprietary code?

Qoder can be used with proprietary code, but organizations should review its actual data flows, enabled features, model providers, retention rules, and contractual terms before using it with highly confidential repositories. For especially sensitive code, verify provider-level handling rather than relying on the autocomplete FAQ alone.

What should I avoid putting into Qoder?

Avoid passwords, API keys, access tokens, private keys, production connection strings, and other secrets. Qoder’s own security documentation explicitly recommends keeping these credentials out of task instructions. (Source: Qoder Security and Authorization)

Sources Used for This Article

• Qoder Privacy Policy, last updated May 12, 2026.
• Qoder FAQ, data security section.
• Qoder Security and Authorization documentation.
• Qoder CLI Tools documentation.
• Qoder CLI Settings Reference.
• Qoder Code Security documentation.
• Alibaba Cloud Qoder runtime and isolation documentation.

Editorial note: Pricing, product features, privacy terms, and provider relationships can change. This article should be rechecked against Qoder’s current official documentation before publication if more than a short period has passed.