You simply cannot have a data policy with a counterparty you cannot name. Ox Alpha appeared on OpenRouter last Thursday (free) from a provider that will not say who it is. 21.8 trillion tokens have gone through it since (almost all of it from coding agents) which means prompts and working source code & Claude Code alone sent 1.57 trillion of that. Two intermediaries have now published a retention policy for that traffic and they contradict each other: OpenRouter's page says your prompts and completions are retained. OpenCode's page says the same provider keeps nothing. Neither of them holds the data so neither sentence is a promise anyone can be held to. People are matching tokenizer counts to work out which lab it is. Okay. What if that code turns up inside a competitor's product, whose name goes on the complaint?