Assume an AI tool can see anything in the folder it works in, plus things like git settings, environment variables and any web access you allow. Treat that as a data-sharing decision.
Practical steps: read the tool's privacy and data-handling settings and switch off anything optional. Review its permission prompts instead of approving everything. Keep secrets, customer data and personal files out of project folders, and exclude .env files. Use a no-reply or work-only email in your git config. For sensitive work, run the tool inside a container or separate user account. Finally, check the vendor's current documentation on what is sent and stored, and ask your IT team to confirm the policy before rolling it out.