Nobody writes “we won’t say”. They write something else instead.

Each of these companies wrote a real, unambiguous commitment that nobody will train on your data — and then scoped it to a third party, one data source, or one moment in the pipeline. Read quickly, it sounds like an answer. Read closely, the vendor's own general use is still unstated. Dashlane scopes by geography rather than by data: “We do not collect, use, or sell personal data for the purpose of training large language models” is the fourth item in a lettered run of US state disclosures — under-18s, then Nevada, then Connecticut, then retention — and it is the Connecticut entry. Connecticut law requires that disclosure, which explains why it is there and not why it appears nowhere else. Clue scopes by silence rather than by words: its AI features are opt-in on explicit consent and it states plainly that no data reaches Anthropic, then says it operates a foundation model “trained by Clue” without ever saying what on. Starling’s AI notice says “no external AI models are trained using Starling data”, and that what it stores about your use of its AI features goes to improve them. Outside models are ruled out. Its own aren’t mentioned. Flo’s Privacy Portal FAQ asks whether your data trains Flo’s AI, and answers that it “is not used to train third party AI models”. Of Flo’s own models it says nothing. In 2021 its CTO spoke of training models “on Flo's large user population”, and no later document repeats or withdraws that.

Asked directly, Zendesk answered directly: it trains Service Data into its native features, and customers can opt out at any time by contacting their Account Manager. Both halves were new, and neither is in anything Zendesk publishes — "Account Manager" appears zero times in the addendum and zero times in the privacy notice. The grade rests on an email rather than on anything a customer could look up, which is precisely the position a reader who never writes a letter is left in. Glean stood here until 20 August 2026, when its commitment turned out to be published on its own trust centre, one click from the front page. Being told an answer is confidential is not evidence that it is.

These companies answer the question somewhere this site didn't read at first. Replit did it somewhere its privacy policy doesn't: a blog post, which says public Repls are used for AI training. Manus did it in the policy itself, in a revision of 28 September 2026: de-identified data may be used "to develop and improve our models", and the opt-out depends on where you live. Each entry quotes the sentence now and carries no grade yet, because this site writes to a company before it publishes an adverse finding about it. Replit is being written to at the address in its privacy policy, which this site missed until 10 October 2026. Manus was written to again on 2 October 2026 about the new wording. Each moves once the letter has gone and the reply, or the silence, is on record.

Eight companies name the setting that controls training — some of them precisely, down to the menu it sits in — and not one says which way it ships. ElevenLabs gives you the "Data use" menu under "Terms and Privacy"; Cursor names "Privacy Mode"; Strava names "Product Improvements" and says it is on web and mobile; Wispr Flow renamed its switch to "Improve the model for everyone". Canva is the sharpest case: it states defaults five times in its privacy policy, every one about who can see a design, and never about whether training is on. Read the privacy policies and you learn exactly how to turn it off, and never whether you need to. That gap is the whole difference between a C and a D on this site — C is for training that is on by default where the product tells you so, and these eight made it unavailable. The information is not withheld from you by accident; the sentence that would settle it is one line long and none of them has written it.

Here the only sentence in the document that takes a firm position on training is a restriction on the reader. You may not train on their content. Whether they train on yours does not come up.

A purpose broad enough to cover training without ever naming it. These are the clauses where a company had the opportunity to write “we do not train on your content”, or “we do”, and instead wrote something that survives either reading. Commonwealth Bank is the variant worth noticing: it says recordings are reviewed “to improve AI-generated summaries of calls”, which describes improving an AI feature while leaving open whether the recordings are training data. MyFitnessPal is the same shape with the tooling named rather than the feature: personal information used “to improve and enhance our Services, including through the use of various technologies (e.g., business intelligence tools, machine learning systems, and artificial intelligence)”. It tells you what is being run over your food and exercise logs, and still not whether those logs are in a training set. Blink is the affiliate variant: video and audio from cameras in homes, collected “to provide and continually improve the products and services of Blink and its affiliates” — the affiliate being Amazon — with no narrower purpose stated anywhere.

Training is stated outright — and then made conditional on something the same document does not resolve: terms that depend on your plan, or a feature description that stops short of saying what happens generally. Eufy’s qualification is scope: the one training clause in Anker’s group policy covers “public materials only” — community-forum posts — while the cameras the brand actually sells go unmentioned by it. Oura’s qualification is the object. The heading says Large Language Model Training; the sentence under it says personal data may be used to develop, test, improve and support “Oura’s own AI, machine learning, and large language model-powered features”, and the one after rules out selling it to train somebody else’s. Features, not models, and the word train used of its own systems nowhere — from a ring that holds heart rate, sleep stages and body temperature. It sat under the heading above until 12 September 2026, on a reading that had described only the second sentence.

The only “AI” in SimpliSafe’s privacy policy is the title of a different document: an “AI Addendum” governing “Shared Video Content”, which the policy names and does not contain. That is materially different from silence — the question has been answered somewhere, in writing — but the somewhere is not the policy in front of the reader, and until the addendum is captured and read, the answer might as well not exist. It is the obvious next fetch, and this entry will be re-read against it.

The rights taken are sweeping and precisely drafted. The purposes are listed. Training is not among the words used. Stack Overflow's document had used the word accurately a paragraph earlier, about somebody else. Krea's terms take a perpetual licence to "otherwise fully exploit" what you submit, and the only no-training promise Krea publishes is in its Business Terms, for Business plans.

“Training” is an ordinary English word before it is a technical one, and a policy that uses it without saying which sense it means leaves the reader to guess. These are not evasions of the kind elsewhere on this page — there is no AI language anywhere near them — which is exactly why they cannot be resolved by reading further. Samsung is the case that matters most: recordings of a customer’s voice and face, used “for training and quality control purposes”, in a document that never uses the words “artificial intelligence” or “machine learning” once. Read as staff review it is unremarkable and probably correct. Read the other way it is the whole question. The document does not choose, so neither do we.

AI appears, but as a product surface, a definition, or a bare confirmation that the company uses it — never as a use of your data. Nothing here can be read as permission to train, and nothing rules it out, which is why these stay unresolved rather than being graded on inference. Depop is the narrowest: “machine learning” appears exactly once in its policy, attached to catching fraud and spam, and the word “train” not at all — a marketplace holding listings, messages and photographs, describing the one use of ML that is about removing users rather than learning from them. Reddit is the loudest silence: its policy names OpenAI’s ChatGPT and mentions licensing fees for bulk access to content, and still never uses the word “train” — the one company here whose AI arrangements are a matter of public record. Six more joined in August 2026 and they share a shape worth naming: each is specific about what its AI *does* and silent about what built it. Pipedrive names the material — “Pipedrive communications with Clients and Users”. Workday runs AI over the content of its calls and meetings. Opera says its assistant is “powered by OpenAI and Google”, so it can tell you where your words go and not what happens to them there. Shopify is the most carefully drafted: machine learning glossed as automated decision-making, with a human kept in the loop — a promise about consequences that leaves inputs untouched. None of the six uses any form of the word “train”. Three more joined them, and each holds something people would not hand over lightly. Bumble names OpenAI as the provider behind its icebreakers and states a 30-day retention period — mechanism disclosed, purpose not. Headspace defines AI, separates the behind-the-scenes uses from the ones you opt into, and lists “machine learning algorithms” among the things your personal information powers; powering a model and training one are different claims, and only the first is made. Gong records sales calls and optimises AI on them under legitimate interest, which is what training accomplishes without being the word for it. Four more, and the last is the one to read. Sourcegraph logs “prompt titles, prompt categories, query-derived metadata” from its AI features and never says what the models learn from — granularity about the metadata that makes the silence about the inputs hard to read as oversight. Hinge and Tinder carry identical Match Group wording naming machine learning as a means of developing features, never as something data feeds. And Flo sends “Personal data relating to cycle dates, goals, symptoms” to a named sub-processor its own policy calls a “Machine Learning Development Platform”, without once using the word “train”: reproductive health data arriving somewhere models are built, and no sentence saying whether it builds them.