This analysis describes what Cursor's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Codebase indexing is an opt-in action that results in code being transmitted to Cursor's servers, which affects where the user's code resides.
The updated policy clarifies that Cursor maintains zero data retention agreements with all AI model providers and customer data will not be used for training by Cursor. However, the policy now explicitly discloses that model providers may run risk classifiers to detect policy violations, and if your prompts or conversations trigger abuse detectors, your data may be stored for investigation and deleted according to the provider's retention policies. The policy removed the previous blanket statement that code would never be trained on by Cursor or third parties, replacing it with more specific disclosure of abuse detection practices. You can review OpenAI and Anthropic's documentation directly for details on their specific retention policies.
View change record →If the reader chooses to index their codebase, their code will be uploaded to Cursor's servers in small chunks.
How other platforms handle this
GitHub Codespaces and github.dev offer Visual Studio Code in a web browser, where some telemetry is collected by default.
You may give us your Identity Data, Contact Data, Financial Data, Profile Data, and other information by filling in forms or by corresponding with us by post, phone, e-mail or otherwise.
telemetry information collected includes: (i) microservice settings, (ii) usage data and (iii) hardware environment.
"If you choose to index your codebase, Cursor will upload your codebase in small chunks to our server to compute embeddingsExcerpt from Cursor's Data Use & Privacy Overview
Netflix updated its Privacy Statement on April 18, 2026, disclosing voice recording collection and expanded household ad profiling for the first time.
Google's Privacy Policy covers Search, Gmail, YouTube, Maps, and every site running Google Analytics. Here is what it actually authorizes.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
Codebase indexing is an opt-in action that results in code being transmitted to Cursor's servers, which affects where the user's code resides.
If the reader chooses to index their codebase, their code will be uploaded to Cursor's servers in small chunks.
ConductAtlas has identified this type of provision across 296 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Cursor.