If Privacy Mode is off, Cursor states it may use your codebase data, prompts, editor actions, and code snippets to train its AI models, and may share prompts and limited telemetry with third-party model providers you select.
This analysis describes what Cursor's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes the full scope of data use when Privacy Mode is disabled, authorizing collection and use of codebase data, prompts, and editor actions for AI model training and disclosure to third-party model providers.
The updated policy no longer explicitly discloses how Cursor handles plaintext code and metadata during codebase indexing. Previously, the policy stated that plaintext code ceases to exist after each request and that embeddings and metadata may be stored in the database. The removal of this language creates ambiguity about current data handling practices for users who index their codebases.
View change record →The updated policy clarifies that Cursor maintains zero data retention agreements with all AI model providers and customer data will not be used for training by Cursor. However, the policy now explicitly discloses that model providers may run risk classifiers to detect policy violations, and if your prompts or conversations trigger abuse detectors, your data may be stored for investigation and deleted according to the provider's retention policies. The policy removed the previous blanket statement that code would never be trained on by Cursor or third parties, replacing it with more specific disclosure of abuse detection practices. You can review OpenAI and Anthropic's documentation directly for details on their specific retention policies.
View change record →With Privacy Mode off, the document authorizes Cursor to store and use codebase data, prompts, editor actions, and code snippets for AI training purposes, and to share prompts and limited telemetry with third-party model providers when those providers are explicitly selected by the user.
How other platforms handle this
We will also provide an individual opt-out choice, or opt-in for sensitive data, before we share your data with third parties other than our agents, or before we use it for a purpose other than which it was originally collected.
to request that your data be transferred to a third party (data portability)
Your organization may allow you to access and export your data in order to back it up or transfer it to a service outside of Google.
"If you choose to turn off "Privacy Mode": we may use and store codebase data, prompts, editor actions, code snippets, and other code data and actions to improve our AI features and train our models. Prompts and limited telemetry may also be shared with model providers when you explicitly select their models.Excerpt from Cursor's Data Use & Privacy Overview
(1) REGULATORY LANDSCAPE: This provision implicates GDPR Articles 6, 9, and 28, particularly the lawful basis for using code data (which may contain personal data) for AI model training and the obligations applicable to sharing …
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Search "[your state] attorney general consumer complaint" to find your state's direct complaint form
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision establishes the full scope of data use when Privacy Mode is disabled, authorizing collection and use of codebase data, prompts, and editor actions for AI model training and disclosure to third-party model providers.
With Privacy Mode off, the document authorizes Cursor to store and use codebase data, prompts, editor actions, and code snippets for AI training purposes, and to share prompts and limited telemetry with third-party model providers when those providers are explicitly selected by the user.
ConductAtlas has identified this type of provision across 290 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Cursor.