The Developer Privacy Report: Exactly What VS Code, Copilot, Cursor, and npm Are Collecting About You

Every developer tool you use is collecting data about you. Not theoretically. Right now, as you read this, your IDE is logging which files you opened, your package manager remembers what you installed, and your AI coding assistant just sent your function to a server you don't control.

We're not talking about malware. We're talking about the legitimate, documented, often-buried-in-settings data collection happening inside the tools millions of developers use every day.

Here's exactly what the most popular developer tools are collecting, what they do with it, and how to shut it down.

VS Code: Microsoft's Window Into Your Workflow

Visual Studio Code is the most popular code editor in the world with over 15 million users. It's also one of the most aggressive data collectors in your toolchain.

What it collects by default:

• Every feature you use and how often
• Which extensions you install and interact with
• Your project structure metadata
• Performance metrics and crash reports (including stack traces)
• Programming languages you work with
• Debugging session details
• File type distributions across your projects

The critical detail most developers miss: VS Code's telemetry setting only controls the editor itself. Extensions can and do collect their own telemetry independently. Microsoft's own documentation admits this: "These extensions may be collecting their own usage data and are not controlled by the telemetry.telemetryLevel setting."

That means even if you've disabled telemetry, every extension you've installed might still be phoning home.

The alternative: VSCodium is a community-maintained build of VS Code with all Microsoft telemetry stripped out. Same editor, same extensions, zero tracking. It's a drop-in replacement.

How to lock it down: Set telemetry.telemetryLevel to off in settings. Then audit every extension individually for its own telemetry controls.

GitHub Copilot: Your Code Leaves Your Machine

This is the one that should concern you most if you work on proprietary code.

GitHub Copilot works by sending context from your editor to Microsoft's servers. That means your code, your comments, your function names, your variable naming patterns, and sometimes your API keys and credentials are transmitted to external infrastructure.

What gets sent:

• The file you're currently editing (or significant portions of it)
• Open tabs for additional context
• Your prompts and chat messages
• Code suggestions you accept or reject
• Repository metadata

The training data question: For free-tier users, telemetry is enabled by default and your data can be used to improve the model. Copilot Pro users get a commitment that their code won't be used for training, but the code still leaves your machine for inference. Copilot Business and Enterprise offer stronger guarantees with IP indemnity.

The real risk: A developer working on a client project under NDA fires up Copilot, and their proprietary business logic gets sent to Microsoft servers. Even if it's not used for training, it was transmitted and temporarily processed on infrastructure you don't control. That can violate confidentiality agreements.

How to lock it down: Disable telemetry collection in Copilot settings. Use content exclusions to block sensitive repositories. For Business/Enterprise, enable the "no code retention" policy.

Cursor: Privacy Mode Isn't What You Think

Cursor has exploded in popularity as an AI-native code editor. Its privacy story is more nuanced than the marketing suggests.

Default behavior (without Privacy Mode):

• Your code is sent to Cursor's servers and to third-party model providers
• Code snippets may be stored in their vector database (Turbopuffer) for codebase indexing
• Prompts and completions are logged
• For accounts created after October 15, 2025, this data may be shared with model providers

With Privacy Mode enabled:

• No plaintext code is stored on their servers
• Code isn't used for training
• But your code still leaves your machine for every AI interaction

The critical distinction: Privacy Mode stops storage and training, but not transmission. Your proprietary code still travels through Cursor's infrastructure to reach the AI model. For developers under strict NDAs, that transmission alone can be a compliance issue.

How to lock it down: Enable Privacy Mode. Use .cursorignore to exclude sensitive files. Consider whether the AI features are worth the transmission risk for your specific project.

JetBrains IDEs: The Opt-Out That Doesn't Fully Opt Out

IntelliJ IDEA, PyCharm, WebStorm, and the rest of the JetBrains family collect telemetry across four categories:

1. Anonymous telemetry: Feature usage statistics
2. Detailed code-related data: Code structure patterns (opt-in)
3. Error reports: Stack traces and environment details
4. AI feature data: Prompts and completions when using JetBrains AI

In May 2025, Reddit users discovered that JetBrains IDEs were contacting analytics servers even when users had explicitly opted out of data collection. JetBrains stores all collected data on EU servers and claims they never sell it, but the opt-out behavior raised serious trust questions.

Their newer AI features collect additional data categories. If you use JetBrains AI Assistant, your code context is sent to their servers (or third-party model providers) for processing.

How to lock it down: Disable "Data Sharing" in settings. Disable anonymous usage statistics. Audit network connections if you need verification. Skip the AI Assistant for sensitive projects.

Next.js and Vercel CLI: Framework-Level Tracking

If you build with Next.js, the framework itself collects telemetry. Every time you run next dev, next build, or next start, Vercel is notified about:

• Which Next.js features you use
• Build performance metrics
• Plugin and configuration patterns
• General usage statistics

Vercel claims they don't collect file paths, file contents, or environment variables. But they do collect enough to build a detailed profile of your technology choices and development patterns.

The Vercel CLI has its own separate telemetry layer on top of whatever your framework collects.

How to lock it down: Run npx next telemetry disable or set the environment variable NEXT_TELEMETRY_DISABLED=1. For Vercel CLI: vercel telemetry disable.

npm: Your Dependency Graph Is a Competitive Intel Goldmine

Every npm install transmits data to npm's registry servers. While the package installation itself is necessary, the metadata collected reveals:

• Your full dependency tree
• Which versions you're using (and which you've updated)
• Your IP address and user account
• Installation patterns and timing

For companies, your dependency graph reveals your entire technology stack, architectural decisions, and even which internal tools you're building. A competitor could learn a lot from knowing you just installed a payment processing SDK, a specific ML framework, or an experimental database driver.

How to lock it down: Use a private registry or proxy (Verdaccio, Artifactory). Audit install scripts with npm audit. Consider --ignore-scripts for untrusted packages.

The Supply Chain Angle: When Your Dependencies Spy For Someone Else

Beyond legitimate telemetry, the npm ecosystem has become a battleground for malicious data collection. In March 2026, North Korean threat actors published 26 malicious npm packages disguised as developer tools. Microsoft also recently disclosed a campaign using malicious Next.js repositories with hidden VS Code scripts that beacon to attacker infrastructure.

These aren't theoretical risks. A single npm install of a compromised package can exfiltrate environment variables, cloud service tokens, SSH keys, and source code.

Sentry, Datadog, and Error Tracking: Stack Traces Contain Secrets

Error monitoring tools like Sentry collect stack traces, environment details, user information, and custom context data when errors occur. That stack trace might contain:

• Database connection strings
• API keys passed as function parameters
• User PII from request contexts
• Internal service URLs and architecture details

These tools exist to help you debug, but the data they collect is among the most sensitive in your entire pipeline.

How to lock it down: Configure data scrubbing rules. Strip sensitive parameters before they reach the error tracker. Use Sentry's before_send callback to filter data.

The Aggregate Problem

Any single tool's telemetry might seem harmless. But combine VS Code's feature tracking with Copilot's code analysis, npm's dependency graph, Vercel's build metrics, and Sentry's error reports, and you've created a comprehensive profile of your development practices, technology choices, project scale, team size, and business direction.

No single vendor sees the whole picture. But if you're using Microsoft products across the board (VS Code + Copilot + GitHub + npm + Azure), one company now has a remarkably complete view of your development life.

The Practical Privacy Checklist

Here's what to do this week:

IDEs:

• VS Code: telemetry.telemetryLevel: "off" + audit extensions
• Or switch to VSCodium
• JetBrains: Disable Data Sharing + verify with network monitoring

AI Coding Tools:

• Copilot: Disable telemetry, use content exclusions for sensitive repos
• Cursor: Enable Privacy Mode, configure .cursorignore
• For NDA work: consider whether any AI assistant is worth the transmission risk

Frameworks & CLIs:

• Next.js: NEXT_TELEMETRY_DISABLED=1
• Vercel CLI: vercel telemetry disable
• Create React App, Angular CLI, and others have similar flags

Package Managers:

• Use npm audit before installing new packages
• Consider a private registry for enterprise work
• Never run install scripts blindly: --ignore-scripts then review

Error Tracking:

• Configure data scrubbing in Sentry/Datadog
• Use before_send hooks to strip sensitive data
• Review what's actually being captured in your error reports

Network Level:

• Use a tool like Little Snitch, Lulu, or Wireshark to see what's actually leaving your machine
• You'll be surprised

The Bottom Line

Your dev tools aren't evil. Telemetry helps build better products. But "opt-out" should mean opt-out, privacy mode should mean privacy, and developers deserve to know exactly what's being collected before it leaves their machine.

The tools that respect your data exist. VSCodium, self-hosted error tracking, private registries, local-first AI models. The question is whether you value your privacy enough to spend 30 minutes setting them up.

For most developers writing personal projects, the default telemetry is probably fine. But if you're working on proprietary code, client projects, or anything under an NDA, your current tool configuration is likely violating agreements you signed. That's worth fixing today.