With Privacy Mode disabled, the document authorizes Cursor to use and store codebase data, prompts, editor actions, and code snippets for AI model training and feature improvement, and to share prompts and limited telemetry with model providers selected by the user.
This analysis describes what Cursor's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision authorizes broad use of source code and prompt data for AI training purposes when Privacy Mode is off, including data categories that may contain proprietary code, personal data of third parties, or trade secret information depending on the nature of the user's codebase.
The updated policy no longer explicitly discloses how Cursor handles plaintext code and metadata during codebase indexing. Previously, the policy stated that plaintext code ceases to exist after each request and that embeddings and metadata may be stored in the database. The removal of this language creates ambiguity about current data handling practices for users who index their codebases.
View change record →The updated policy clarifies that Cursor maintains zero data retention agreements with all AI model providers and customer data will not be used for training by Cursor. However, the policy now explicitly discloses that model providers may run risk classifiers to detect policy violations, and if your prompts or conversations trigger abuse detectors, your data may be stored for investigation and deleted according to the provider's retention policies. The policy removed the previous blanket statement that code would never be trained on by Cursor or third parties, replacing it with more specific disclosure of abuse detection practices. You can review OpenAI and Anthropic's documentation directly for details on their specific retention policies.
View change record →Under these terms, users who do not enable Privacy Mode have their codebase data, prompts, editor actions, and code snippets potentially used for AI model training and shared with model providers, with the scope of 'limited telemetry' not precisely defined in this document.
Cross-platform context
See how other platforms handle AI Model Training Use When Privacy Mode Is Disabled and similar clauses.
Compare across platforms →"If you choose to turn off 'Privacy Mode': we may use and store codebase data, prompts, editor actions, code snippets, and other code data and actions to improve our AI features and train our models. Prompts and limited telemetry may also be shared with model providers when you explicitly select their models.Excerpt from Cursor's Data Use & Privacy Overview
(1) REGULATORY LANDSCAPE: This provision implicates GDPR lawful basis requirements for processing personal data for AI training purposes, CCPA disclosure and opt-out requirements for sharing personal information with third parties, and FTC Act standards for …
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision authorizes broad use of source code and prompt data for AI training purposes when Privacy Mode is off, including data categories that may contain proprietary code, personal data of third parties, or trade secret information depending on the nature of the user's codebase.
Under these terms, users who do not enable Privacy Mode have their codebase data, prompts, editor actions, and code snippets potentially used for AI model training and shared with model providers, with the scope of 'limited telemetry' not precisely defined in this document.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Cursor.