Is Replit safe? What's public, what trains AI, and what Agent can touch

The Morse teamPublished November 7, 202610 min read

As of November 7, 2026, Replit is safe for prototypes and code you'd be fine seeing in a training set, but on its free Starter plan and its $20 Core plan you can't stop Replit from using your prompts, context, and Agent's replies to improve its models. An app you publish from your personal workspace is public by default. Replit's Agent can't modify your production database, a separation Replit's CEO promised after the Agent deleted a user's production data in July 2025.

We read Replit's privacy policy (updated October 21, 2026), terms of service (August 3, 2026), Pro Agreement, subprocessor list (August 2026), security page, pricing page, and about 20 of its docs pages on November 7, 2026, plus the posts its CEO and the affected user wrote about the deletion. Replit earns credit in two places. It publishes, in plain tables, which database its Agent can write to and how far back each one can be restored, and its CEO called the deletion "Unacceptable" in public, two days after it was reported.

Replit safety at a glance

Read on November 7, 2026, from Replit's own pages.

Are Replit projects public?

Your published app is public by default, and the code you post to your profile can be too. Replit's terms say "Content in apps is not made available to the public." Its January 9, 2026 changelog says "Builders on free accounts can now create private apps." Many guides written before then still say every app on a free Replit account is public, which no longer matches Replit's pages.

Publishing is where the public default remains. Replit's docs say "apps in your personal workspace default to Public," meaning "Anyone on the internet with the URL can use your app." The other choices are a shared password, Workspace only, and Invite only. Pick one under Sharing in the Publishing tool before you hit Publish, because changing it later "requires unpublishing your app first."

Your profile can be public too. The privacy policy says your name, username, picture, and "code, and other profile information may be viewable and searchable by other users and search indexed by online search engines," and that content you post, "including your code and forum posts," is "visible to other users by default."

Does Replit train on your code?

Yes, unless you're on Replit Pro and switch it off, or on Enterprise. Replit's model improvement page says: "We use content you provide, including your prompts, instructions, context, and responses generated for you, to help develop and improve our models and AI features." It then says "This control is available to Pro users," and "For Enterprise users, Replit does not use customer content to train its models."

As of November 7, 2026, Replit Pro costs $100 a month and Core costs $20 (Replit pricing), so the opt-out costs five times as much as Core. On Replit Pro, go to Settings, then Personalization, and opt out of Model Improvement. The page says that stops only "new content" from being used, and that opting out "does not delete your content."

The Pro Agreement says the same in contract terms: Replit "may also use Customer Content to develop, train, and improve its models and AI Features." For Starter and Core, the privacy policy lists "to improve the accuracy of our machine learning technologies such as code generation" as a legitimate interest, and the terms give Replit the right to "copy, display, distribute, perform, reformat, and modify your content" and to sublicense those rights "to any third party provider for the Service." How GitHub and Anthropic handle the same question is in does GitHub Copilot train on your code.

Can Replit see your private code?

Yes, for stated reasons. The terms say "Replit reserves the right to access the content of your private apps for the purpose of troubleshooting, improving our service, and ensuring the safety and security of the Service."

Your employer can see more on a company account. The privacy policy says "certain data about your activity and use of the platform will be made available to them." On Enterprise, account admins can use a Compliance API to pull the full text of prompts members sent to Agent, which Replit warns "can contain source code, secrets, personal data, or other sensitive information."

Which AI companies see your code in Replit Agent?

Several, and in Free Mode Replit picks. Replit's subprocessor list names Anthropic, OpenAI, and Google for "AI models," along with several AI infrastructure platforms. Its model selector docs list GPT-6 Sol, Claude Sonnet 5, Claude Opus 5.5, and Kimi K3 among the models in Power and Max modes, and say "Free Mode always uses intelligent model routing," so you can't choose there.

Enterprise admins get the most say. Replit's model controls cover OpenAI, Anthropic, Google, DeepSeek, Kimi, and Z.ai, but "At least one model from each of OpenAI, Anthropic, and Google must remain enabled." As of November 7, 2026, we found nothing on Replit's pages saying whether those model companies keep your prompts, or for how long. We explain what to ask for in what is zero data retention.

Are your secrets safe on Replit?

Safer in the Secrets tool than in your code, but Replit's pages describe two different setups. The Secrets docs say secrets are encrypted with "AES-256 encryption at rest and TLS encryption in transit" and made "available to your Replit project as an environment variable." Multiplayer collaborators see both names and values. Organization members without the Owner role can't view values, "but can access their values by printing the environment variables."

Replit's security page says credentials are "injected via a transparent sidecar proxy at runtime" and are "never accessible to the AI Agent." The Secrets docs, read the same day, still tell you to run printenv in the Shell to see every environment variable, and Replit's security guide for Agent's repository work says "A process with access to development credentials can use those permissions." Plan as if any code running in your project, including code Agent wrote, can read a secret. The same guide says to keep sensitive data out of "chat messages." A key pasted there becomes part of your prompt, which on Starter and Core falls under model improvement.

What can Replit Agent change?

Your files and your development database, but not your production database. Replit's database docs say "Agent is not able to modify the production database"; it reads production "through a read replica." Schema changes you make with Agent are applied to production "At the time of publishing," so review them before you publish.

The rule covers the production database Replit manages. If your app connects to an outside database through a connection string you added to Secrets, the docs say "The Database tool only shows databases Replit manages for you," and they don't say Agent's restriction extends to it.

Agent builds by default. Plan mode, where Agent "won't make any changes to your files," needs Core or above (Replit docs). Checkpoint rollbacks restore code but "do not change your database" unless you tick Database, and never touch production (Replit docs). Replit's terms add that "Code generated or suggested by our AI systems may be erroneous or incomplete."

Did Replit's Agent delete a production database?

Yes, and Replit CEO Amjad Masad confirmed it in a post on X. In July 2025, during a public vibe coding experiment by SaaStr founder Jason Lemkin, Replit's Agent deleted data from his app's production database. Lemkin's other claims, that the Agent ignored a code freeze and covered up bugs with fake data, are his account, as reported by The Register. Masad's post said Replit "heard the 'code freeze' pain loud and clear" and didn't address the fake data claim.

Two of Masad's promises are now in the docs: separate development and production databases, and Plan mode. As of November 7, 2026, we couldn't find the postmortem on Replit's blog or docs. Replit's Pro Agreement still says "Replit has no obligation to back up, archive, or recover Customer data," and makes backing up your data the customer's job.

Is Replit safe for company code?

It has the controls a security team asks for, on Enterprise. Replit's security page says it holds SOC 2 Type II and gives every customer "their own isolated Google Cloud project," even on the free tier. Its information security page says data is hosted mainly in US Google Cloud data centers, with an optional India region.

Enterprise admins can require private deployments, ban source code export (which "is not a guarantee that code cannot leave through another route"), and turn on an on-device PII filter that warns about or removes personal information before a message reaches Agent. Replit calls that filter "a best-effort safeguard" that "does not catch every case." Enterprise is also the only plan where Replit says it doesn't train on your content. Text planted in a README or a dependency can steer an agent that reads it, a risk explained in what is prompt injection.

So is Replit safe enough for your project?

• Public apps: choose Invite only or Workspace only under Sharing before your first publish, since changing it means unpublishing.
• Training: on Starter or Core, assume your prompts and Agent's replies are used. On Replit Pro, turn off Model Improvement.
• Secrets: keep keys in the Secrets tool, give collaborators only the access they need, and never paste a key into Agent's chat.
• Agent and your data: use Plan mode before big changes, keep production on Replit's managed database, and set point-in-time recovery to the longest window your plan allows.

How Morse keeps your code questions out of a training set

Each risk above comes from where your code goes. Your code, your prompts, and sometimes your keys sit on Replit's servers under your account, pass to model companies Replit chooses, and on Starter and Core feed Replit's model improvement with no switch to turn it off. Morse is where you can ask about a stack trace, a schema, or a snippet you'd rather not send through your builder's account.

There's no training to opt out of. Whatever plan you're on, Morse doesn't train AI on what you paste, and it doesn't sell your data or show ads. Morse's servers don't keep your messages or log their content. Choose a mode for each chat:

• Private, for the stack trace or schema you'd keep out of Starter and Core's model improvement. Every new chat opens in Private. It runs open-weight models such as DeepSeek, Kimi, and GLM, and xAI's Grok, on providers bound by Morse's zero data retention agreements covering inference, search, and the rest, so none of them keeps your code. When a provider reports zero retention on a reply, Morse verifies that report and rejects any reply without it; otherwise it relies on the provider's commitment.
• E2EE, for code with a live key or a customer's records in it. Before the message goes anywhere, your browser verifies the enclave's hardware attestation and seals the text so only that enclave can open it. Morse's servers pass along ciphertext they can't read. The protection holds as long as the enclave hardware and attestation work as designed. It's part of Morse's Pro plan, $19 a month, and runs open-weight models without web search.
• Anonymous, for a second opinion from GPT, Claude, or Gemini on code Agent wrote. Morse's proxy strips your account, email, and IP address, then sends the request under Morse's own account. The model's provider reads the snippet without knowing it's you and may hold it for a limited time for abuse checks under its own policy, so swap real keys for placeholders before you paste.

A file you attach travels with that one message, and Morse never stores it. Your chat history lives encrypted in your browser, so clearing it or deleting your account erases your chats for good and Morse can't bring them back; commit anything worth keeping to your repo. The details are in our privacy policy, and private AI for engineers has more on keeping work code out of other companies' systems.

Ask your next code question from the Morse home page without an account, or start free with no card needed.