Captured before automated identity checks (Oct 14, 2026): accurate as of its capture on Sep 9, 2026; our capture on Oct 21, 2026 found the same text, but its identity was not checked by them.
Get the weekly coverage letter
Companies change their terms without announcing it. We capture governance documents, compare each new version with the last, and publish what changed, with the source text behind it. One email a week on what we found and what we could not reach.
This page describes what the document states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability may vary by jurisdiction. Methodology
“Customer Data will not be used for training by Cursor.”
“we may use and store codebase data, prompts, editor actions, code snippets, and other code data and actions to improve our AI features and train our models.”
“Cursor maintains zero data retention (ZDR) agreements with all providers, and AI model providers will not store or train on your data.”
“model providers (including Cursor) may run risk classifiers to detect violations of terms and usage policies, and if your prompts or conversations trigger abuse detectors your data may be stored for investigation...”
“Even if you use your API key, your requests will still go through our backend! That's where we do our final prompt building.”
“if your prompts or conversations trigger abuse detectors your data may be stored for investigation and deleted in accordance with their retention policies.”
Cursor's privacy document explains how your code, prompts, and editor activity are handled. Whether Privacy Mode is on or off is the most consequential setting: with it on, Cursor will not use your data for training and will not permanently store cached files; with it off, your codebase data, prompts, and actions may be used to train Cursor's models. If you index your codebase, it is uploaded to Cursor's servers, and metadata such as file names and hashes may be stored even after processing.
This document establishes Cursor's data collection, usage, retention, and sharing practices for its AI-powered code editor. A central axis is Privacy Mode: when enabled, Cursor does not use Customer Data for training, does not permanently store cached file contents, and does not use cached file contents as training data; when disabled, Cursor may use and store codebase data, prompts, editor actions, and code snippets to improve AI features and train models. Account creation date determines data-sharing eligibility with model providers — accounts created before October 15, 2025 are not subject to such sharing — while explicit model selection by a user may trigger sharing of prompts and limited telemetry with the chosen provider. Cursor maintains zero data retention agreements with all model providers, contractually prohibiting those providers from storing or training on user data, subject to an explicit exception for abuse-flagged data, which may be retained by Cursor or model providers for investigation before deletion under retention policies. All requests, including those made with a user's own API key, are routed through Cursor's backend.
Whether your data is used for AI training depends entirely on whether Privacy Mode is active in your Cursor account — enabling Privacy Mode is the direct action that prevents your Customer Data, cached files, and codebase data from being used for training. If your account was created before October 15, 2025, your data will not be shared with model providers regardless of other settings. When you explicitly choose a third-party model provider's model, your prompts and limited telemetry may be shared with that provider, though Cursor's zero data retention agreements contractually bar those providers from storing or training on that data — except if your prompts trigger abuse detection, in which case that data may be stored for investigation. Choosing to index your codebase results in it being uploaded to Cursor's servers, where embeddings and metadata including file names may be retained.
Which mapped governance frameworks each document engages, tied to the specific provisions that engage them.
2 important changes detected
5 versions captured · Latest change detected by ConductAtlas: July 2026
We withheld clauses we had published from this document. Each withholding is recorded in our correction log:
“Customer Data will not be used for training by Cursor.”
“we may use and store codebase data, prompts, editor actions, code snippets, and other code data and actions to improve our AI features and train our models.”
“Cursor maintains zero data retention (ZDR) agreements with all providers, and AI model providers will not store or train on your data.”
“model providers (including Cursor) may run risk classifiers to detect violations of terms and usage policies, and if your prompts or conversations trigger abuse detectors your data may be stored for investigation...”
“if your prompts or conversations trigger abuse detectors your data may be stored for investigation and deleted in accordance with their retention policies.”
“Even if you use your API key, your requests will still go through our backend! That's where we do our final prompt building.”
“All cached file contents are temporary, never permanently stored, and never used as training data when privacy mode is enabled.”
“never used as training data when privacy mode is enabled.”
Every distinct legal provision identified in this document. Featured provisions appear above with analysis.
Cursor has updated this document before. Monitor includes alerts from a daily check, structured change summaries, and monitoring for up to 20 platforms.
Need provision-level monitoring and regulatory mapping? Insight includes governance timelines, drift analysis, and full provision tracking.
Cross-platform context
See how other platforms handle Privacy Mode blocks Cursor training use and similar clauses.
Compare across platforms →Governance Monitoring
Structured alerts for policy changes, governance events, and provision updates across 343 platforms.