Does Claude Code read my .env file?

There is no default exclusion. Anthropic's guidance is to add a Read deny rule such as Read(./.env). A .claudeignore file has no effect, and a deny rule does not stop a script that opens the file itself.

How long does Anthropic keep Claude Code data?

Five years for Free, Pro and Max accounts that allow data use for model improvement, 30 days for those that do not, and 30 days as standard for Team, Enterprise and API. Transcripts sent with /feedback are retained for five years.

Does Anthropic train on Claude Code prompts?

On Free, Pro and Max, Anthropic will train new models using that data when the setting is on. On Team, Enterprise and the API it does not, unless the customer has chosen to provide data for model improvement.

Does Claude Code send my files to Anthropic?

Q: Does Claude Code send my files to Anthropic?

Only the files it reads; it does not scan your disk. But a file it reads becomes part of the prompt, and Anthropic's documentation says the data sent over the network includes all user prompts and model outputs, encrypted in transit via TLS 1.2+.

Only the files it reads, and that is a real limit: it does not scan your disk. But a file it reads becomes part of the prompt, and Anthropic's own documentation says the data sent over the network "includes all user prompts and model outputs". Nothing is excluded by default, including .env.

What goes over the wire

Prompts and outputs. "Claude Code runs locally. To interact with the LLM, Claude Code sends data over the network. This data includes all user prompts and model outputs, encrypted in transit via TLS 1.2+." A file's contents arrive at the model as part of that, which is the whole point of asking it about a file.
Reads do not ask first. In Claude Code's permission table, file reads and Grep are "Read-only" and approval required is "No, within the working directory and additional directories". So the gate on what gets sent is which directory you started in, not a prompt you will see.
Metrics, which are not your content. "Metrics never include your code, prompts, or file paths." DISABLE_TELEMETRY=1 turns them off.
Error reports, sent to a third-party error tracking service, with "known patterns of secrets, file paths, email addresses, and other personal information" redacted first. DISABLE_ERROR_REPORTING=1 turns them off.
One hostname per WebFetch. Before fetching a URL it sends the hostname to api.anthropic.com to check a blocklist: "Only the hostname is sent, not the full URL, path, or page contents."

What happens to it then, by tier

Tier	Used to train models	Retention
Free, Pro, Max — training setting on	Yes	5 years
Free, Pro, Max — training setting off	No	30 days
Team, Enterprise, API	No, unless the customer opts in	30 days standard
Enterprise with zero data retention	No	No server-side persistence

Anthropic's wording on the consumer tiers is direct: "We will train new models using data from Free, Pro, and Max accounts when this setting is on (including when you use Claude Code from these accounts)." The setting lives at claude.ai/settings/data-privacy-controls. Zero data retention is not part of the standard Enterprise plan; it is enabled per organisation after an eligibility check.

Three paths that are easy to miss

/feedback, /bug and /share send a copy of your conversation history including code, and those transcripts "are retained for 5 years". DISABLE_FEEDBACK_COMMAND=1 turns the command off.
The session quality survey. The rating itself records only the rating. The follow-up that asks whether Anthropic may look at your transcript is the one to read carefully: answering yes uploads the transcript and the raw session log, known API key and token patterns are redacted, and "source code, file contents, and other conversation content are uploaded as-is". Shared transcripts are kept up to six months.
The copy on your own disk. Session transcripts are stored locally "in plaintext under ~/.claude/projects/ for 30 days by default". That is not a network path, but it is a readable copy of everything, and cleanupPeriodDays is how you shorten it.

Does it read my .env file?

There is no default exclusion. Claude Code's own guidance is to add one: "To block Claude's file tools from reading a file or directory, add a Read deny rule for its path, such as Read(./.env) or Read(./secrets/**)." Two details that catch people out:

.claudeignore does nothing. "If your project has a .claudeignore file, it has no effect, so move its entries into Read deny rules."
A deny rule is not a wall. It covers the file tools and the shell commands Claude Code recognises — cat, head, tail, sed, tee, and redirections. It does not cover "a command that reads files without naming them, such as grep -r pattern .", or a Python or Node script that opens files itself. For that, the documentation points at the sandbox.

The only version of this with no network in it

Point the CLI at a model on your own machine and the question dissolves, because there is no provider in the path. That is a base URL and a token, and it is the subject of its own note.

It is also why Nico runs the CLI already on your Mac rather than proxying anything: your prompts go to your own subscription under that provider's terms, or to Ollama and nowhere. Three things ever leave the Mac on Nico's account — a model download, a licence check about once a month carrying a key and a machine fingerprint, and an update check at most once a day carrying nothing.

← All notes