Does Codex train on your code? OpenAI's settings, and the exceptions

The Morse teamPublished November 2, 20268 min read

Yes, by default: as of November 2, 2026, OpenAI may use your Codex tasks to train its models if you use Codex with a personal ChatGPT account (Free, Plus, or Pro), unless you turn off Improve the model for everyone. A second setting, Include environments, separately decides whether your full Codex environments can be used too. OpenAI doesn't train on Codex use through ChatGPT Business, Enterprise, or Edu, or through an API key, by default.

We read OpenAI's help center articles on model training, data controls, deleting Codex chats, Advanced Account Security, Daybreak, and usage limits, its Codex documentation on security, cloud environments, authentication, local history, memories, and Computer History, its pricing page, and its API data page, all on November 2, 2026. Every fact below links to the OpenAI page it came from. OpenAI deserves credit for documenting its local switches plainly: telemetry is off by default, and one line of configuration keeps Codex from saving transcripts to your disk.

Codex training settings at a glance

Does Codex train on your code by default?

Yes, on personal accounts. OpenAI's data controls page says that on "personal workspaces with ChatGPT Free, Plus, or Pro, data sharing is enabled by default" (OpenAI). Its training page says the same opt-out "is sufficient for ChatGPT conversations and Codex tasks" (OpenAI). Codex is part of your ChatGPT account, so the switch you set for chat is the switch for your repositories.

Business plans start from the opposite default. OpenAI says it doesn't use inputs or outputs "from ChatGPT Business, ChatGPT Enterprise, ChatGPT Edu, or our API to improve our models" by default (OpenAI). OpenAI's pages don't name the $8 Go plan in either list, though Go includes Codex (OpenAI).

How do you stop Codex from training on your code?

Turn off two settings, then mind a third habit.

1. Improve the model for everyone. On the web, open your account menu, choose Settings, then Data controls, and turn it off (OpenAI). Selecting Do not train on my content in OpenAI's Privacy Portal does the same, and "you don't need to do both" (OpenAI). We cover this switch, and what it leaves out, in does ChatGPT train on your data.
2. Include environments. Open Codex settings and turn it off. OpenAI says this setting controls "whether additional context from your Codex environments can be used to train OpenAI models," and that changing your ChatGPT setting or the Privacy Portal "does not change that setting" (OpenAI).
3. Skip the thumbs. Even after you opt out, rating a reply lets OpenAI use "the entire conversation associated with that feedback" for training on Free, Plus, and Pro (OpenAI). For a coding agent, that conversation can include the code it read.

OpenAI's page promises only that after you opt out, it won't use your "new conversations" (OpenAI), so turn it off before you point Codex at a private repository. As of November 2, 2026, OpenAI's pages don't say whether Include environments starts on or off, so check it yourself rather than assume.

When can Codex train on your code with training off?

In two cases on OpenAI's own pages, and a third page that points the other way.

• Feedback, as above: a rating opens the whole conversation to training.
• Daybreak sessions. Daybreak is OpenAI's reduced-refusal access for authorized security work, and in Codex you turn on its toggle "before making a request" (OpenAI). OpenAI's data controls page says that "during Daybreak sessions on your personal account, we may use content from your interactions to improve our models even when 'Improve the model for everyone' is off" (OpenAI). Daybreak approval also doesn't include zero data retention (OpenAI).
• Advanced Account Security points the other way. OpenAI's page for this optional sign-in mode says "conversations are not used to train OpenAI models while Advanced Account Security is enabled" (OpenAI). Neither page says which rule wins for a Daybreak session on an account that has both.

The guides ranking for this question on November 2, 2026 cover the main switch and the business exemption. The ones we read don't mention the Daybreak exception or the local transcript file.

Where your code goes in each Codex surface

Read on November 2, 2026, from OpenAI's Codex documentation and help center.

A Local chat runs its commands on your computer, yet OpenAI's deletion page treats it like any other chat kept on OpenAI's systems. The 30-day deletion window also has an exception for users who "allow us to use your content to improve our models" when the chat "has already been de-identified and disassociated from your account" (OpenAI).

Is the Codex CLI private?

More than the cloud, and OpenAI documents how to make it more so. The CLI runs in an operating-system sandbox with "no network access and write permissions limited to the active workspace" by default (OpenAI). Telemetry is "off by default," and if you turn it on, OpenAI advises keeping log_user_prompt = false because "prompts can include source code and sensitive data."

The local transcript is on by default. OpenAI says Codex "saves local session transcripts under CODEX_HOME," and setting persistence = "none" under [history] in config.toml stops it (OpenAI). Turn it off, or delete the file, if anyone else uses your machine or its backups.

Signing in with an API key moves you onto API rules. OpenAI's API page says that since March 1, 2023, API data "is not used to train or improve OpenAI models" unless you opt in (OpenAI). Codex cloud "requires signing in with ChatGPT," so this route covers local work only (OpenAI). We compare the API with the apps in is the OpenAI API private.

Does Codex cloud keep your secrets?

It keeps them out of the agent's reach where you let it. OpenAI's cloud environments page offers two kinds of value: an environment variable is "passed directly to programs," while a network secret gives programs "a placeholder" that a proxy swaps for the real value only for allowed domains (OpenAI). Use network secrets for tokens, so a command the agent runs never sees the raw credential.

Code leaves a cloud task through its internet access. In the legacy cloud, OpenAI blocked internet access during the agent phase by default and listed "code or secret exfiltration" and prompt injection among the risks of turning it on (OpenAI). An issue or README the agent reads can carry instructions; we explain the attack in what is prompt injection. Allow only the domains a task needs.

How Morse keeps your code questions out of training

Every rule above follows from Codex working inside your repository under your ChatGPT account, so that account's switches, its server-side chat list, and its 30-day deletion window apply to everything the agent reads. Morse is a chat app on the web, and Morse never uses the code you paste to train AI, so there's no switch to find. The Free plan includes coding, file, and other chat tools.

• Private, for a stack trace or function you'd rather no host kept. New chats open in Private. Your account, email, and IP address come off before an open-weight model such as DeepSeek, Kimi, or GLM, or xAI's Grok, reads the code, and under Morse's zero data retention agreements with its inference, search, and other providers, the hosts keep nothing. When a provider confirms zero retention on a reply, Morse checks that confirmation and refuses a reply that lacks it. Read what zero data retention means.
• E2EE, for code you can't let anyone read. Before the code leaves your device, your browser verifies the enclave's cryptographic proof and seals the message so only that enclave can open it. Morse's servers pass along ciphertext they can't read. The guarantee holds as long as the enclave hardware and attestation work as designed, and E2EE is part of Pro. Here's how end-to-end encrypted AI chat works.
• Anonymous, for GPT, Claude, or Gemini under Morse's name instead of yours. The proxy sends your message under Morse's own account, with your account, email, and IP address taken off. The provider reads the code without knowing it's you and may hold it for a limited time for abuse checks, under its own policy, so replace API keys and internal hostnames before you paste.

In all three, Morse doesn't train AI on your content, sell your data, or show ads. Your chat history is stored in your browser, encrypted, instead of in a server-side list with a 30-day tail. Attached files go with the message and are never stored by Morse. Clearing your browser deletes those chats for good, and Morse can't bring them back, so keep anything you'll need. The Morse privacy policy has the details.

Which Codex setting to change, by worry

• Your repository training a future model: turn off Improve the model for everyone and Include environments, and don't rate replies. Morse doesn't train AI on your chats, so there's nothing to turn off.
• A transcript on your laptop: set [history] persistence = "none", and delete ~/.codex/history.jsonl.
• Secrets leaking from a cloud task: use network secrets, keep internet access to named domains, and point the agent only at trusted issues.
• A question about code you can't show anyone: ask it in an E2EE chat on Morse.

You can start free with no card. E2EE chats come with Pro, at $19 a month.