Docker

The reviewed policy does not offer a simple no-AI-training commitment for all service, usage, or account data.

Docker still collects activity, feature usage, and product-version data that can support service improvement.

Docker's reviewed policy focuses on service, activity, feature-usage, and product-version data instead of saying all repository content is default training data.

Organization and repository controls can limit how much sensitive content is exposed before optional services or integrations are enabled.

Docker says it does not engage in profiling or automated decisions with legal or similarly significant effects.

Docker allows disclosure to service providers, subprocessors, affiliates, legal recipients, and customer organizations.

Repository visibility and image content are still customer-managed, so mispublished images or weak org settings can expose more than intended.

Docker publishes privacy, DPA, subprocessor, and privacy-rights materials for customer review.

Organization admins can govern repository visibility, organization membership, and token access.

Private repositories and managed organizations offer stronger sharing boundaries than public registries and unmanaged personal use.

Docker collects IP addresses, device identifiers, browser and device data, and service activity information.

The policy allows analytics, advertising, and similar vendor involvement around Docker's websites and services.

Docker says it does not engage in profiling or automated decisions with legal or similarly significant effects.

Privacy request and preference paths are documented in the policy.

Private organizations and repositories reduce public visibility even when service telemetry still exists.

Docker says retention depends on service use, account state, legal requirements, and customer-controller context.

Customer organizations can keep copies of repository, membership, or operational data outside a single user's direct control.

Docker documents privacy request and preference paths rather than offering only informal support channels.

Organization governance can narrow long-term exposure by deactivating members, rotating tokens, and managing repository access.

Private registries and managed account contexts give teams more control over data lifecycle than fully public publishing flows.

Admins can manage organizations, repositories, access tokens, and visibility settings.

Docker provides privacy request and preference paths for personal data handling.

Private repositories let teams keep images and metadata off the public internet by default.

Organization-level governance gives managed deployments more structure than unmanaged personal use.

Sensitive information baked into images or published in public repositories is still largely the user's responsibility.

Customer-controller and organization contexts can leave end users with less direct self-serve control than admins.