Cursor — privacy & data policy

Provider: Anysphere. PromptPrivacy score: 69/100. Last verified August 26, 2026.

What happens to your data?

Anysphere collects account details, technical usage data, and any code or inputs you submit to generate suggestions and maintain the service. Your inputs and suggestions are not used to train AI models by default unless you explicitly opt in or submit feedback. Data is shared with necessary infrastructure and model vendors under strict instructions and retained only as long as required for business and legal purposes.

Does it train on your data?

Anysphere does not use Inputs or Suggestions to train its models, nor does it allow third parties to use them for training, unless the data is flagged for security review, explicitly submitted as feedback, or the user has explicitly consented to training.

Can you opt out?

Yes. Model training on inputs and suggestions is opt-in by default, and training preferences can be managed directly in the service settings. Users can also request data deletion or object to processing by emailing hi@cursor.com.

Data retention

Anysphere retains personal data only for as long as necessary to operate the service and fulfill legitimate business purposes, including legal compliance, dispute resolution, safety, and agreement enforcement. Interaction history duration may depend on user settings, and temporary interactions may be stored for a limited duration for safety and monitoring. When data is no longer needed, Anysphere deletes, erases, de-identifies, or anonymizes it.

Encryption & security

The policy specifies that Anysphere implements commercially reasonable technical and organizational measures to protect personal data from loss, misuse, unauthorized access, disclosure, alteration, or destruction. Specific encryption standards (such as TLS or AES) or formal certifications are not detailed in the text.

Is it safe for work?

Yes. Cursor provides strong defaults against model training on user code inputs and suggestions without explicit permission. Furthermore, enterprise and workplace accounts are covered under dedicated commercial customer agreements where Anysphere acts as a data processor.

Source policy: https://cursor.com/privacy