Bring Zero Data Retention (ZDR) to Individual / Kilo Pass Plans

[ueberBrot]

Hey everyone!

I’m currently looking into switching from GitHub Copilot to Kilo. I'm really impressed so far, but I noticed something while looking through the docs: Zero Data Retention (ZDR) compliant providers and models seem to be restricted to Enterprise plans.

I reached out to Kilo Support about this, and Ligia from their team recommended I post the suggestion here to see how the rest of the community feels about it!

As an individual developer (and I’m sure many freelancers/contractors here can relate), code privacy and data security are just as critical for my personal and client projects as they are for massive enterprise teams. Right now, it looks like we can't get that same level of privacy configuration on the personal credit-based or Kilo Pass tiers.

The Request:
It would be amazing if Kilo could open up ZDR model configuration to individual users. Strong data privacy is a baseline requirement for many freelancers and solo developers, not just a premium perk for enterprises.

Would love to hear your thoughts! Is this something other solo devs and freelancers would find valuable? If so, please drop an upvote or a comment so the Kilo team can see the demand for it alongside their roadmap.

[eriktechgrounds]

@ueberBrot I do see the 'Zero Data Retention' option in the provider routing section of the VSCode plugin (and have it applied). I would expect this to function as such?

I couldn't yet find (so still am looking for) an overview of which models support this setting. I've found when selecting one of the more recent Chinese models, I was presented with a message that 'This model doesn´t support Zero Data Retention' - so that made me think the setting at least works.

EDIT: The actual error message is:

400
KiloCode completion error: 400 "Data collection is required for this model. Please enable data collection to use this model or choose another model."

But as @ueberBrot mentions in below comment, this is still something different than enforced ZDR routing. I would also much prefer this, as it would make selecting from the compliant models a lot easier.

[ueberBrot]

@eriktechgrounds Thanks for sharing that screenshot! I actually haven't used the VS Code extension or Kilo Code CLI yet because support mentioned ZDR wasn't implemented for individuals.

Looking closely at your image, it actually seems to confirm what Support told me. Right below the 'Zero data retention' dropdown, there is a button that says 'Create an Organization to Manage Provider Routing'.

This means that in order to actually configure and use that routing, you have to set up an organization which to my knowledge requires a Team subscription (starting at around $15/month per developer) before you can even use your AI credits.

Regarding the warning message you saw when selecting that Chinese model: if ZDR routing were truly active and enforced on your account (similar to how strict routing works on platforms like OpenRouter), the system wouldn't let you select or use a non-compliant provider at all. The fact that it only surfaces a warning likely means the setting isn't actually functioning or enforcing privacy for individual accounts.

My feature request is specifically about bringing that actual, functional ZDR routing to individual plans, so solo devs and freelancers aren't forced to upgrade to a team tier just for baseline data privacy.

[mihado]

I didn't realise they moved this to enterprise only. I bought credit when they first lauch and their comm promoted zero lock-in, being transparent etc. I've rechecked the new extension today and this setting is now unavailable. Not happy at all !!!

[jalabulajunx]

Yes, me neither. As in, I was not aware that ZDR was removed from individual use. I logged in to Kilo after about 3 months and now I don't have an option to enable ZDR. UNBELIEVABLE!

[mihado]

Anyone from Kilo want to comment on these points? Did I get it right?

Kilo.ai Terms of Service Analysis

Source: https://kilo.ai/terms
Last updated: January 29, 2026
Reviewed: June 28, 2026

---

Executive Summary

Kilo.ai's Terms of Service present a significant gap between their public narrative (open source, transparency, developer-first) and their legal terms (vague, broad data rights, minimal accountability). The terms grant Kilo extensive rights to user data with limited opt-out mechanisms and no meaningful guarantees.

---

Key Concerns

1. Data Collection by Default

Section 7A — Customer Data:

• Any code, prompts, or content uploaded to the service grants Kilo a perpetual, irrevocable, fully-paid, royalty-free, worldwide, sublicensable, transferable license
• License covers use to "provide and improve the Service and Kilo's other products and services"
• No time limit on retention; no deletion mechanism specified in terms

Section 7B — Usage Data:

• Performance, analytical, and usage data collected automatically by default
• Kilo "reserves the right to use Usage Data for any purpose"
• Can anonymize, aggregate, and use aggregated data to improve products
• No opt-out mechanism exists for Usage Data collection

2. Vague and Ineffective Opt-Out

The only opt-out language appears in Section 7A:

"If you elect not to grant a license to any AI Model to use your Customer Data for training purposes, you may not be able to use certain AI Models."

Problems with this opt-out:

• Only applies to third-party AI model training, not to Kilo's own use of your data
• Framed as a consequence (loss of functionality) rather than a data protection right
• No mechanism described for how to exercise this opt-out
• Kilo retains its license to Customer Data regardless of this opt-out
• No opt-out exists for Usage Data collection at all

3. Open Source Branding vs. Proprietary Terms

The contradiction:

• Kilo markets itself as open-source friendly (VS Code extension, community, GitHub presence)
• Terms grant Kilo proprietary, permanent rights to all user data
• Section 5D: Feedback becomes Kilo's property — "unrestricted, perpetual, irrevocable" with no attribution required

4. Assignment Without Consent

Section 16A:

• Kilo can assign the entire Terms agreement — including all data rights — to any third party (acquirer, partner, successor) without user notification or consent
• Your data rights transfer automatically to the new entity

5. No Warranties, Limited Liability

Section 13 — Disclaimers:

• Service provided "AS IS" and "AS AVAILABLE"
• Disclaims all warranties: merchantability, fitness for purpose, non-infringement, quiet enjoyment
• No guarantee of uptime, security, or error-free operation

Section 14 — Limitation of Liability:

• No liability for indirect, incidental, special, consequential, or punitive damages
• Aggregate liability capped at: amount paid in last 6 months OR $100 (whichever is greater)
• This allocation is described as "an essential element of the basis of the bargain"

6. Unilateral Modification Rights

Section 10:

• Kilo can modify Terms at any time
• Continued use after modification = acceptance
• Only notification: updating the date at the top of the page
• No affirmative consent required for material changes

7. Broad Indemnification

Section 12:

• User must indemnify Kilo for claims arising from: unauthorized use, Terms violation, third-party rights violation, disputes with other users
• Kilo can assume defense control at user's expense
• User must cooperate with Kilo's defense of claims

---

Comparison to Industry Norms

Aspect	Kilo.ai	Industry Best Practice
Data retention	Perpetual, no deletion mechanism	Defined retention windows, deletion on request
Usage data opt-out	None	Configurable settings
AI training opt-out	Vague, loss of functionality	Clear toggle, no functionality penalty
Terms modification	Unilateral, continued use = consent	Material changes require affirmative consent
Data assignment	Automatic, no notice	Notice and/or consent required
Liability	Capped at $100 or 6 months	Higher caps or uncapped for gross negligence

---

Risk Assessment

High Risk:

• Perpetual, irrevocable data licenses with no deletion mechanism
• Usage Data collection for "any purpose" with no opt-out
• Automatic assignment of data rights to third parties
• Unilateral Terms modification without affirmative consent

Medium Risk:

• Vague AI training opt-out tied to functionality loss
• Broad indemnification obligations
• AS IS disclaimers with minimal liability caps

Low Risk:

• Standard arbitration clause (Section 15)
• Standard eligibility requirements (Section 2)

---

Recommendations

1. Do not use Kilo.ai for proprietary or sensitive code until terms are clarified
2. Assume all data uploaded is retained permanently by Kilo
3. Assume Usage Data is collected and used for any purpose Kilo deems fit
4. Review privacy policy at https://kilo.ai/privacy for additional data handling details
5. Consider alternatives with clearer data handling policies (Cursor, GitHub Copilot, etc.)
6. Document any communications with Kilo about data practices for potential disputes

---

Red Flags Summary

• Markets open source transparency while retaining broad proprietary data rights
• Opt-out exists only for third-party AI training, not Kilo's own use
• No opt-out for Usage Data collection
• Perpetual, irrevocable licenses with no deletion mechanism
• Automatic assignment of data rights without user consent
• Unilateral Terms modification with continued use as acceptance
• AS IS disclaimers combined with minimal liability caps
• Gap between public narrative and legal terms indicates potential credibility issues

---

Analysis based on Terms of Service retrieved June 28, 2026.

[wgomg]

So, zero response on this by kilo team?