What Free AI Tiers Do With Your Prompts: A 2026 Census

Free AI tier data terms are where vendor privacy policies diverge most — and the divergence is almost never on the pricing page. This census reads the published terms of eleven hosted model APIs and records, in each vendor’s own words where a page states them, what happens to prompts sent on a free tier, a trial key, a free quota, or a promo-priced window.

The stakes are concrete. Two vendors state outright that their free tier runs on different data terms than their paid tier. Two more have no free tier to compare at all, which is itself a finding. One vendor’s policy reads as training-by-default across every tier. And on the day this census was compiled, a promo-priced model at the center of the week’s news cycle raised the question all over again: does a discount change what happens to your data?

What follows is the method, the complete eleven-row table, the two clean free-versus-paid asymmetries quoted verbatim, a five-way typology of vendor postures, and the two places where a gateway’s summary of a vendor disagrees with the vendor’s own documentation — arguably the most useful finding in the set.

Free tiers, trial keys, and promo windows are how most teams first touch a hosted model API — and they are precisely the surfaces where data terms are least likely to be read. A paid enterprise contract gets a legal review. A free API key gets pasted into a prototype the same afternoon. If a vendor’s terms treat those two surfaces differently, the difference lands exactly where nobody is looking.

The pattern this census found is not a scandal; it is an asymmetry of disclosure. Some vendors state the free-versus-paid split plainly and in detail. Some publish one policy and say it covers everything. Some publish a policy that never mentions the free surface at all. And for one vendor, no vendor-primary page could be located at all. The census’s job is to separate those four situations — because “the vendor discloses a training default we dislike” and “the vendor discloses nothing” are different procurement facts that call for different responses.

Scope. This census covers hosted model APIs only — the raw inference endpoints a developer calls with an API key. Coding agents and harnesses are excluded entirely. That population — seventeen agents, six fixed questions — is our coding-agent data terms census from August 17, and this post is its hosted-model-API companion: the same documentation-only form applied to a different population, not an extension of it. If you came here for what a coding agent does with your code, that is the table you want.

Sourcing rule. Where a commonly repeated figure could not be confirmed on a fetched vendor-owned page, the cell reads not established — never an inference from the paid tier, a sibling product, or a forum report. Where no vendor-primary page was located for a row at all, the row says so rather than borrowing terms from a sibling surface.

Vocabulary. Each cell uses a four-way standard: disclosed (the vendor’s own page states the behaviour, in words quoted here), not disclosed (the page was located and read; it does not address the question), not established (a claim circulates but was not confirmed on a fetched vendor-owned page), or page not located (no vendor-primary page was found for that specific question). Four cited pages carry no absolute last-updated date and are labelled undated. And this is deliberately a census — rows and citations — not a checklist; the questions-to-ask form of this same concern is our AI procurement questions guide, and the single-vendor deep-dive form is our look at Fable 5's 30-day retention and enterprise ZDR.

The table below is the asset — all eleven rows, no summary substitution. Cells read not disclosed, not established, or page not located per the vocabulary above — never an inference. Data as of August 26, 2026, from vendor-owned pages only.

One scope note on row 11: Alibaba Cloud Model Studio’s raw API is a different commercial surface from OpenRouter’s hosting of Qwen models, and the hosted Qwen3.8-Flash is a different artifact again from the open-weight Qwen3.8-Flash-Next — a split we unpack in our companion piece on the Qwen open-weights-versus-hosted split. This row is about Model Studio’s own terms and nothing else.

Only two of the eleven vendors publish an explicit free-versus-paid data-terms split under their own name — and both deserve credit for the disclosure, because the disclosure is exactly what lets a buyer decide.

Google is the marquee example. The Gemini API Additional Terms of Service (updated April 28, 2026) state that for the free tier, “Google uses the content you submit to the Services and any generated responses to provide, improve, and develop Google products and services,” and that “human reviewers may read, annotate, and process your API input and output.” For paid services, the same document flips the default: “Google doesn’t use your prompts (including associated system instructions, cached content, and files such as images, videos, or documents) or responses to improve our products,” with logging “for a limited period of time, solely for detecting and preventing violations of the Prohibited Use Policy.” One document, two regimes, both in plain language. There is also a regional override: users in the EEA, Switzerland, and the UK get the paid-tier data-protection terms even on the free service.

Mistral is the second clean case, with a wrinkle. Its help center states that free Experiment-tier users may opt out of training but must do so manually, while pay-as-you-go customers are opted out by default — the same shape as Google’s split, expressed as toggle defaults. The wrinkle: a second Mistral page on privacy and data controls says flatly that “data sent through the API isn’t used for model training,” which sits in tension with the help article’s free-tier opt-in default. Per this census’s method, we record both statements rather than silently picking one; the two pages may describe different surfaces, but the vendor’s own docs do not say which.

“Does the free tier train on your data?” sounds like a yes/no question. Across the ten vendors with a located primary page it resolves into five distinct postures — and knowing which posture a vendor occupies tells you what to check next. A sixth posture below belongs to the aggregator layer, not to any vendor row. The patterns overlap at the edges: Anthropic, for instance, sits in both the no-carve-out group and the no-free-tier group, because its trial credits run under one uniform commercial document. xAI is placed in no posture at all: with no vendor-primary page located, there is no disclosed posture to place it in.

The trend worth interpreting: disclosure quality does not track vendor size. The two clearest free-tier disclosures come from the largest company in this table and a mid-sized European lab; the vaguest cells belong to vendors of every scale. What predicts clarity is whether the vendor decided to productize the free tier at all — vendors that treat free usage as a named product write terms for it, and vendors that treat it as marketing spillover mostly do not.

OpenRouter publishes a live per-provider table recording each upstream provider’s retention and train-on-prompts posture on its privacy and logging page (undated). Reading that table against each vendor’s own documentation is the census’s best cross-check: where the two agree, you get independent corroboration; where they disagree, you get a genuine finding. It disagrees twice, and leans stronger than the vendor once.

The disagreement between a gateway’s summary of a vendor and the vendor’s own docs is not a nuisance to be edited away — it is arguably the most useful thing in this census. It tells you that the retention number you see in an aggregator UI is a characterization, made in good faith, of documents that are sometimes vaguer or more configurable than a single cell can hold. OpenRouter is also explicit that its free/paid training toggle “has no bearing on OpenRouter’s own policies and what we do with your prompts” — the setting governs routing eligibility to upstream providers, not the gateway’s own logging, which is a separate question we examine in our companion piece on what OpenRouter’s charts actually measure.

This census shipped on the day the stealth listing ox-alpha was revealed as Z.ai’s GLM-5.3-Flash, which makes row 5 topical: the model is running a promotional pricing window through September 9, 2026, and promo windows are exactly the kind of surface this census exists to check. The answer from the terms page is clean. Z.ai’s Terms of Use (updated April 14, 2026) draw one line — consumer surface versus API surface — and the promo window appears nowhere in it. For API and business users: “We will not use End User Content for developing or improving Services, unless you explicitly agree to such use.” For consumer users, the terms are training-permissive: Z.ai reserves the right to process User Content to improve and develop its services. A promo price is a cost change, not a documented data-terms change.

The stealth window itself is a separate story with its own data-terms angle — the listing’s no-training promise during the anonymous period, which we covered when the listing first appeared. Here, post-reveal, the relevant fact is the now-attributed vendor’s standing API terms — a different question with a documented answer. And what stealth listings in general do and do not disclose is territory we mapped in our identity-blind evaluation guide; this census deliberately does not re-cover it.

A census is only useful if it changes behaviour. The honest decision rules that follow from the table:

Looking forward: expect the free-tier terms gap to narrow, because the aggregator layer is already forcing the issue. When a routing gateway operationalizes the question of whether a provider may train on your prompts as separate account settings for paid and free models, vendors whose pages are silent start to look worse than vendors who disclose an unflattering default — and the commercial pressure runs toward disclosure. Until then, the census form is the right defence: rows, citations, and a refusal to infer. If your team is standing up AI workloads and needs the data-terms diligence done against your own risk profile — including which tiers your prototypes are actually allowed to touch — our AI transformation engagements start with exactly this kind of vendor-terms review.