Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
With Privacy Mode disabled, the document authorizes Cursor to use and store codebase data, prompts, editor actions, and code snippets for AI model training and feature improvement, and to share prompts and limited telemetry with model providers selected by the user.
This analysis describes what Cursor's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision authorizes broad use of source code and prompt data for AI training purposes when Privacy Mode is off, including data categories that may contain proprietary code, personal data of third parties, or trade secret information depending on the nature of the user's codebase.
The updated policy clarifies that Cursor maintains zero data retention agreements with all AI model providers and customer data will not be used for training by Cursor. However, the policy now explicitly discloses that model providers may run risk classifiers to detect policy violations, and if your prompts or conversations trigger abuse detectors, your data may be stored for investigation and deleted according to the provider's retention policies. The policy removed the previous blanket statement that code would never be trained on by Cursor or third parties, replacing it with more specific disclosure of abuse detection practices. You can review OpenAI and Anthropic's documentation directly for details on their specific retention policies.
View change record →Under these terms, users who do not enable Privacy Mode have their codebase data, prompts, editor actions, and code snippets potentially used for AI model training and shared with model providers, with the scope of 'limited telemetry' not precisely defined in this document.
Cross-platform context
See how other platforms handle AI Model Training Use When Privacy Mode Is Disabled and similar clauses.
Compare across platforms →Monitoring
Cursor has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"If you choose to turn off 'Privacy Mode': we may use and store codebase data, prompts, editor actions, code snippets, and other code data and actions to improve our AI features and train our models. Prompts and limited telemetry may also be shared with model providers when you explicitly select their models.Excerpt from Cursor's Data Use & Privacy Overview
(1) REGULATORY LANDSCAPE: This provision implicates GDPR lawful basis requirements for processing personal data for AI training purposes, CCPA disclosure and opt-out requirements for sharing personal information with third parties, and FTC Act standards for clear and conspicuous disclosure of data use practices. The use of codebase data for training may also engage trade secret and intellectual property considerations where enterprise users' proprietary code is involved. (2) GOVERNANCE EXPOSURE: High for enterprise users. The authorization to use codebase data, prompts, and editor actions for model training introduces significant data governance exposure for organizations whose developers use Cursor with Privacy Mode off, particularly where the codebase contains personal data or proprietary business logic. The term 'limited telemetry' is not defined in this document, creating uncertainty about the scope of data shared with model providers. (3) JURISDICTION FLAGS: EU and EEA users face heightened exposure under GDPR, as training on personal data embedded in code requires a documented lawful basis and potentially a data protection impact assessment. California users may have CCPA rights to opt out of sharing of personal information that applies to this provision. Enterprise deployments subject to sector-specific regulations such as healthcare or financial services face additional exposure where codebases may contain regulated data categories. (4) CONTRACT AND VENDOR IMPLICATIONS: Enterprise procurement and legal teams should assess whether employee or contractor use of Cursor with Privacy Mode off constitutes an unauthorized disclosure of proprietary code under internal data governance policies, and whether vendor agreements with Cursor adequately address the training use authorization described in this provision. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should audit current Privacy Mode settings across enterprise deployments, assess whether opt-in or opt-out mechanisms for training data use satisfy applicable consent requirements, and update data processing records to reflect this provision's authorization of training use when Privacy Mode is disabled.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision authorizes broad use of source code and prompt data for AI training purposes when Privacy Mode is off, including data categories that may contain proprietary code, personal data of third parties, or trade secret information depending on the nature of the user's codebase.
Under these terms, users who do not enable Privacy Mode have their codebase data, prompts, editor actions, and code snippets potentially used for AI model training and shared with model providers, with the scope of 'limited telemetry' not precisely defined in this document.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Cursor.