Lovable announced on 2026-07-31, with formal notice given on 2026-08-05, that from September 9, 2026 it may use customer data from the Free and Pro plans to train its AI models. That is six days from this post. The opt-out is free, takes about ten seconds, and most people building on Lovable have not heard about it.
The part worth acting on today is the timing. Opting out before the 9th and opting out after the 9th produce different outcomes, and Lovable says so plainly.
TL;DR
Free and Pro are opted in by default from September 9, 2026. The toggle is in Settings, then Your account, it costs nothing, and it doesn't degrade any AI feature. Two things people get wrong: opting out only counts going forward, so doing it before the 9th is the only version where your content is never used at all, and the setting is per person rather than per workspace. If you are on Business, check the setting rather than trusting the summary; Lovable's own docs disagree with each other about your default.
What is in scope
Lovable's data opt-out documentation defines customer data like this:
prompts (including images and files you attach), code, project files, hosted applications, configurations, and generated outputs
Its FAQ and the Summary of Changes give a slightly different list: the same items minus "hosted applications" and "configurations", plus usage data. Three descriptions from the same company, three lists. Take the union rather than the flattering subset, since nothing says the shorter lists are narrowing anything.
Two entries deserve a second read.
"prompts (including images and files you attach)." Not just the code Lovable wrote for you. The things you typed at it, and the things you dragged into the chat. Think about what that has actually included over the life of your project: an error message pasted straight out of a terminal, a screenshot of a dashboard, a CSV you attached so the model could infer a schema.
"configurations." Configuration is where connection strings live.
What is not in scope
Worth stating as clearly as the risks, because the alarming version of this story is wrong.
Lovable excludes end-user data. Its wording: "information your apps' visitors or customers submit stays in your project's own database and storage, and is not used to train our models." Account and billing details are excluded too.
So this covers what you put into Lovable while building. Not what your customers put into the thing you shipped.
If you are on Business, do not trust the summary
This is the one place Lovable's documentation contradicts itself, and it matters because it decides whether you need to do anything at all.
The opt-out page says Business and Enterprise workspace data "is excluded from model training by default. No opt-out is needed."
The privacy and security settings reference describes a workspace-level toggle called Use workspace content for model training and lists its default as: "Enabled on Business, Disabled on Enterprise."
Enabled means use the workspace's content for training. So one page says Business is excluded by default and another says the Business default is on.
We are not going to guess which is authoritative. There's a reading where both are true, in which the contractual agreement governs and the toggle just lets an admin state the choice explicitly, and Lovable's settings page gestures at that. But it is an inference, not something either page states, and "your enterprise agreement probably covers it" is a thin thing to rest customer code on.
If you administer a Business workspace, open Settings, then Privacy and security, and look at the actual state of that toggle. Then you know. Enterprise appears unambiguous; Business does not, and the two are not interchangeable here.
How to opt out
Open Lovable and go to Settings, then Your account, then the AI model training section.
Turn the content-training toggle off. Go by the section, not the label: Lovable's account settings docs call it "Use my Lovable content for model training", while the 2026-08-07 changelog entry renaming these settings calls it "On Your Customer Content". There is one toggle and two published names for it.
If you administer a Business or Enterprise workspace, check the separate workspace-level control under Settings, then Privacy and security, per the section above. Lovable states that an account-level opt-out always applies regardless of the workspace setting, so your personal toggle is not overridden by it either way.
Get everyone else who works on the project to do step 1 and 2 for themselves. The next section is why that is not optional.
Two reassurances from Lovable's own docs, so nobody talks themselves out of it: the setting is "available on any plan", and turning it off "is free and doesn't affect your use of AI features." No paywall, no feature penalty.
The bit almost nobody notices: it is per person
From Lovable's account settings documentation, the setting "covers only your own data and does not change the setting for other members of a workspace you belong to."
Read that again if you work with anyone.
You can opt out, feel done, and still have your project's code in scope because your co-founder never touched their own toggle. Or the contractor you onboarded for three weeks in June. Their prompts are about the same codebase, and their attachments are your project files. The opt-out protects your account, not your project.
For Free and Pro there is no documented admin switch that does this on everyone's behalf. It's a conversation you have to have with each person.
Why the date matters more than the toggle
Here's the asymmetry that makes this a this-week job. Lovable's documentation says opting out
takes effect going forward: your content is excluded from all training data assembled after your opt-out takes effect. It does not retract content from training datasets assembled, or models trained, before then.
"Or models trained" is the half worth noticing. A dataset can in principle be rebuilt. A model that has already been trained is not something an opt-out reaches into.
And for people who move before the deadline: "If you opt out before September 9, 2026, training under the updated policy will not have started, so your content is not used for training at all."
| When you opt out | What happens |
|---|---|
| Before 2026-09-09 | Training under the new policy hasn't started, so your content isn't used at all |
| After 2026-09-09 | Excluded going forward. Datasets already assembled, and models already trained, stay as they are |
Nothing about the second row is unreasonable, and it is how nearly every training opt-out works. It just isn't reversible, which makes this a deadline rather than a setting.
The secrets question, answered carefully
The obvious worry: you pasted an API key into a Lovable chat six weeks ago while debugging a webhook. Is that now training data?
Being precise here matters, so two separate things.
What the documentation says. Nothing in Lovable's opt-out page, settings reference, Summary of Changes, security page or changelog commits to filtering, redacting or scrubbing credentials out of training data on Free or Pro. That's an absence, not an admission. But prompts are in scope by Lovable's own definition, and a pasted key sits in a prompt.
What we could not check. The operative text is Section 5 of the updated Privacy Policy, which takes effect on the 9th and is not publicly readable today. We tried. So the honest statement is that Lovable's published documentation contains no commitment to filter secrets from training data, not that Lovable will train on your API keys. Those are different claims and only the first one is sourced.
There is one more detail that sharpens this, from Lovable's own sensitive data scanning docs. Lovable does ship machinery for exactly this problem: it detects "Passwords, API keys, and other authentication secrets" and can redact them before a chat message is sent. Its prerequisites are one line long:
To use sensitive data scanning, you need: An Enterprise plan.
So the documented mechanism for keeping a pasted credential out of chat history is available on the one tier whose data is least likely to be training material anyway.
The action item doesn't depend on any of the above. Rotate every credential you have ever pasted into a chat window, in any tool. A secret that has been through a chat log has more copies than you can account for: your session history, the provider's logs, your own scrollback, and whatever the model did with it. This deadline is just the nudge to finally do it.
The five minutes actually worth spending
Opting out is the easy part. If you are already in there, the more valuable pass is working out what you have handed over in chat.
Where we sit. CheckYourVibe scans deployed apps, so we have no visibility into anyone's Lovable account settings and nothing to sell you on this page. We wrote it because the failure next door, a credential that reached somewhere it should not have, is what we see constantly.
Does Lovable train its AI models on my code?
From September 9, 2026, on Free and Pro, yes, unless you opt out. Lovable's notice covers customer data, which it defines as "prompts (including images and files you attach), code, project files, hosted applications, configurations, and generated outputs". Two of its three published descriptions also list usage data.
How do I opt out of Lovable AI model training?
Settings, then Your account, then the AI model training section, then turn the content-training toggle off. Go by the section rather than the label, because Lovable's docs and its August 7 changelog name that toggle differently. It is available on any plan, it is free, and Lovable says it "doesn't affect your use of AI features".
Does opting out remove data Lovable already has?
No. Lovable says opting out "takes effect going forward" and "does not retract content from training datasets assembled, or models trained, before then". Opting out before September 9, 2026 is the only route where your content is not used at all.
Does my opt-out cover my whole team?
No. Lovable's account settings docs say the setting "covers only your own data and does not change the setting for other members of a workspace you belong to". Everyone on the project has to do it themselves.
Is Business or Enterprise excluded by default?
Enterprise clearly is. Business is ambiguous in Lovable's own documentation: the opt-out page says Business and Enterprise are "excluded from model training by default", while the privacy and security settings reference gives the workspace training toggle a default of "Enabled on Business, Disabled on Enterprise". On Business, open the setting and look.
Your settings are one half of it
Scan your deployed Lovable app and see the keys, headers and endpoints it hands to anyone who loads the page.