The only statement they can make which is accurate is that they will not train on private data.

They might train on your data if it's public. If your code is public, and it doesn't get pulled into their dataset, they won't train on it.