agreed. when using local models, they did send your prompts to openai with 30 day retention to make the titles, silently.

their recent changes to the privacy policy broke their promise of zero data retention. specifically, they offered chatgpt luna under a zero data retention privacy policy. luna was later shown to be 30 days retention.

their privacy policy has never guaranteed your prompts will not be logged and when asked they have failed to revise it.

when challenged about sending data to openrouter without listing it as a 3rd party processor they offered a dismissive response. the same with running prompts through cloudflare. seems trivial, but signifies general disinterest in security.

by default if you run the harness outside your config file by accident, it will automatically run silently with a free model that sends your prompts and local data to an endpoint with training enabled. on top of that it used to dump all the prompts sent to free models into an s3 bucket, the feature was literally called 'datadumper' in the source.

Plus 100 to this. Of all the harnesses I find it to be the worst. IMO training should always require opt in and the way they continue to run their business/framework is shady.