Did OpenCode Go Drop Zero Data Retention? DeepSeek V4 Flash Is the Exception
OpenCode Go did not drop zero data retention for every model, but its live policy now marks DeepSeek V4 Flash as used for training with no retention agreement.
No, OpenCode Go did not drop zero data retention for every model. But its live data-policy table now identifies DeepSeek V4 Flash as a clear exception: training use is marked "Used" and retention is marked "No agreement." Fourteen of the other listed models still show no training and zero-day retention, while two show no training and 30-day retention.
Watch The 30-Second Summary
Last updated: August 1, 2026
The Short Answer
The important change is not that all of OpenCode Go suddenly became non-private. It is that a single privacy promise no longer describes every model available through the service.
OpenCode Go's current documentation lists 17 models with model-specific data terms:
| Current OpenCode Go policy | Models | What the table says |
|---|---|---|
| No training, zero-day retention | 14 | "Not used" and "0 days" |
| No training, 30-day retention | 2 | "Not used" and "30 days" |
| Training use, no retention agreement | 1 | DeepSeek V4 Flash: "Used" and "No agreement" |
DeepSeek V4 Pro remains in the zero-day, no-training group. That means users cannot safely infer privacy terms from the vendor name or model family alone. The exact model and route matter.
The change attracted immediate community attention because OpenCode Go had previously made a broader zero-data-retention promise. The repository history shows that the wording changed twice on July 31: first to accommodate the newest DeepSeek model, then to publish a model-by-model policy table.
What Is Confirmed
1. The live OpenCode Go table makes DeepSeek V4 Flash an exception
OpenCode's live Go documentation marks DeepSeek V4 Flash as "Used" under training and "No agreement" under retention. That is materially different from the 14 models marked "Not used" and "0 days."
It is also different from Grok 4.5 and GPT 5.6 Luna, which are marked as not used for training but retained for 30 days. Those two columns answer separate questions: whether data may be used for training and how long it may be retained.
2. OpenCode replaced a blanket promise with model-specific terms
The first July 31 repository change revised OpenCode Go's hosting language and added an explicit opt-in warning for the newest DeepSeek version hosted in China. At that point, the page still said user data would not be used for model training.
About 8 hours and 47 minutes later, a second repository change replaced that blanket sentence with the current per-model table. The later change is the more useful disclosure because it shows the exception instead of implying one policy applies everywhere.
3. DeepSeek's own policy describes broad collection and training uses
DeepSeek's privacy policy says its services may collect prompts, uploads, feedback, and chat history, and that collected information may be used to improve and train its technology. It also describes an opt-out right, variable retention periods, and processing and storage in the People's Republic of China.
That policy does not prove the exact handling of every request routed through OpenCode Go. It does explain why OpenCode's route-specific "Used" and "No agreement" labels matter: the upstream provider's general terms do not supply the same contractual zero-retention commitment shown for other Go models.
4. The model can also be run outside OpenCode Go
The official DeepSeek V4 Flash model card provides downloadable weights and deployment instructions for vLLM and SGLang. In other words, the OpenCode Go route is one way to access the model, not the model's only possible privacy architecture.
Self-hosting may give an organization more control, but it does not automatically create a private system. The runtime, server access controls, logs, tool calls, telemetry, network egress, backups, and operators still need review.
What Is Still Unclear
Several important facts are not established by the public documentation:
- "Used" does not prove that every individual DeepSeek V4 Flash prompt is selected for training. It is a policy category that permits training use.
- "No agreement" does not prove indefinite retention. It means the table does not offer a defined retention agreement for that route.
- The public documents do not provide a route-specific deletion schedule, opt-out mechanism, or detailed processor chain for DeepSeek V4 Flash through OpenCode Go.
- There is no public evidence here of an OpenCode data breach, leaked prompt database, or retrospective change to how older prompts were handled.
- The broad OpenCode privacy notice does not establish which fields are logged for each individual model request.
OpenCode's general privacy policy describes information collected through its hosted services and says data may be retained as needed for service, business, legal, or dispute purposes. It also distinguishes the hosted service from locally run open-source software. That broad notice is useful context, but it cannot replace a model- and route-specific data-processing agreement.
Why the Distinction Matters
Privacy labels often collapse several different controls into one reassuring phrase. "Zero data retention" sounds like a property of an app. In a multi-model AI service, it is more often a property of a particular route under particular contractual terms.
One coding session can involve multiple layers:
- The local OpenCode client.
- The OpenCode Go hosted gateway.
- The selected model provider.
- Tool servers, search systems, or other integrations.
- Local logs, shell history, caches, and project files.
A zero-retention agreement at one layer does not erase copies created at another. A no-training promise also does not answer how long data is stored, where it is processed, or whether humans can review it.
This is the same trap behind many AI privacy claims: a true statement about one component gets repeated as though it covers the entire workflow.
The ROUTE Test for AI Coding Privacy
Before putting sensitive source code into any hosted coding model, use this five-part check:
R: Runtime and route
Are you using local inference, a vendor-hosted gateway, your own API key, or a third-party subscription route? Record the exact endpoint and model identifier. The same model name can have different terms through different providers.
O: Operators and subprocessors
Identify who can process the request after it leaves the device. Include the app operator, gateway, model host, observability vendors, and enabled tools. A polished client does not make those other parties disappear.
U: Use of submitted data
Look for a direct answer about training, human review, abuse monitoring, evaluation, and product improvement. "We respect privacy" is not a data-use rule.
T: Time retained
Find a concrete retention period for prompts, outputs, logs, and backups. "No chat history" and "not used for training" do not mean zero retention. OpenCode Go's own table now demonstrates why training and retention need separate columns.
E: Exceptions and exact model
Check model-by-model exceptions, geographic routes, beta terms, opt-in warnings, and policy dates. DeepSeek V4 Pro and DeepSeek V4 Flash currently have different entries in the same table. Product-family assumptions are not enough.
For a deeper buyer checklist, see What to Check Before Trusting Any AI Privacy Claim.
What OpenCode Go Users Should Do Now
If your prompt contains proprietary code, credentials, unreleased product details, customer data, or regulated information, take these steps before selecting DeepSeek V4 Flash:
- Verify the exact model in the interface. Do not rely on a remembered default or the vendor family name.
- Treat "Used" as permission for training use. If that is outside your policy, choose another route.
- Treat "No agreement" as an unresolved retention term. Do not substitute your own preferred assumption.
- Use a model currently marked no-training and zero-day retention when those controls are required. Recheck the live table because terms can change.
- Remove secrets before prompting. Redact API keys, tokens, private URLs, customer records, and unnecessary proprietary context.
- Review tools separately. Agent tools can send code or data to search, browser, MCP, shell, and observability systems outside the model route.
- For higher-control workloads, evaluate self-hosting. Then validate network egress, logs, access, deletion, backups, and model-serving security instead of assuming downloaded weights equal privacy.
Teams should also save a dated copy of the policy they approved. The July 31 commit sequence shows how quickly a blanket statement can become a model-specific matrix.
Does Turning Off Training Solve the Problem?
No. Training use is only one part of the data lifecycle.
A service can promise not to train on prompts while retaining them for abuse monitoring, debugging, legal obligations, or account operations. It can also keep metadata after deleting visible chat history. Conversely, a zero-day retention agreement can narrow server storage but still leave local copies, tool outputs, or telemetry elsewhere in the workflow.
These distinctions are covered in more detail in:
- Does Turning Off AI Training Mean Your Chats Are Not Retained?
- Does No Chat History Mean an AI App Keeps No Logs?
- Private AI Chat vs. Local AI
Where OpenVeil Fits
OpenVeil is not a coding agent, an OpenCode replacement, or a way to use DeepSeek V4 Flash. It is a paid, privacy-focused hosted AI chat service for people who want a simpler chat experience with tighter history boundaries.
OpenVeil keeps normal chat history in the browser instead of maintaining a normal server-side chat-history record. Active requests still have to be processed by OpenVeil and necessary providers, and operational or security data can still exist. OpenVeil is therefore not fully offline, anonymous, zero-log, or a defense against every risk in an agentic coding workflow.
The relevant lesson is narrower: privacy claims should name the component, data use, retention window, and exceptions. If you want a hosted chat experience designed around browser-local history rather than a permanent server-side transcript, try OpenVeil and review its privacy information against your own requirements.
Frequently Asked Questions
Did OpenCode Go remove zero data retention?
Not across the whole service. The current table lists 14 models with zero-day retention, two with 30-day retention, and DeepSeek V4 Flash with no retention agreement. The blanket Go-wide framing no longer applies.
Does OpenCode Go use every DeepSeek V4 Flash prompt for training?
The public table says training use is "Used," which permits that use. It does not prove that every submitted prompt becomes training data. Users who cannot accept training use should treat the route as unsuitable unless a stronger agreement applies to them.
Is DeepSeek V4 Pro covered by the same terms?
No. At the time of publication, OpenCode Go lists DeepSeek V4 Pro as not used for training with zero-day retention, while DeepSeek V4 Flash is marked used for training with no retention agreement.
Is the locally installed OpenCode client the same as OpenCode Go?
No. OpenCode is open-source software that can connect to different providers and routes. OpenCode Go is an optional hosted subscription service. Privacy depends on the selected route, model, tools, and local configuration.
Is this evidence of a breach?
No. The evidence is a policy and documentation change, not a reported data breach. The confirmed issue is that one newly listed model has materially different training and retention terms.
Can self-hosting DeepSeek V4 Flash avoid the hosted route's terms?
Running the official weights on infrastructure you control can avoid sending prompts through OpenCode Go, but privacy then depends on your own serving stack, logs, access controls, telemetry, tools, backups, and network configuration.
Bottom Line
OpenCode Go's current disclosure is more precise than its earlier blanket promise. Most listed models still have no-training and zero-day-retention terms, but DeepSeek V4 Flash does not. Its table entry says training data is used and no retention agreement exists.
That is not evidence of a breach, and it does not make every OpenCode Go model equally risky. It is a reminder to audit AI privacy at the exact model-and-route level. For sensitive work, the exception column matters more than the slogan.