This question also applies to OpenAI, anthopic, GitHub (Microsoft) and any server you send your data too.

Not in the same way really. There aren't examples of OpenAI, Anthropic, or GitHub/Microsoft doing the sketchy things that xAI has been involved with. Those companies care a lot about the reputational damage that would come from flouting their customer's data privacy obligations.

Cursor/xAI was making a full copy of every repo it ever touched within the last month, and when caught, just acted like that was an accident. A system to download every repo you touch, and then upload it to persistent cloud storage, doesn't just happen by accident.