Is Cursor private? Privacy Mode, training, and what Cursor still stores

The Morse teamPublished November 1, 20269 min read

As of October 2026, Cursor, the AI code editor made by Anysphere, is private enough for most code only when Privacy Mode is on: with it, Cursor says your code is "never used for training by Cursor or other AI model providers" (Cursor), and with it off, Cursor "may use and store codebase data, prompts, editor actions, code snippets" to train its models (Cursor). Privacy Mode is on by default for teams, but Cursor's pages don't say it's on by default for individual accounts, and even with it on, your code still passes through Cursor's servers and its model providers.

We read Cursor's data use page, security page, privacy policy (last updated October 11, 2026), help and docs pages, pricing page, and its own forum on October 24, 2026. Cursor deserves credit here. It publishes a plain two-paragraph data use page, holds a SOC 2 Type II attestation, and in July 2026 stopped computing embeddings of your code on its servers, which most guides to Cursor privacy haven't caught up with.

Cursor privacy at a glance

Read on October 24, 2026, from Cursor's own pages.

Is Cursor Privacy Mode on by default?

For teams, yes. Cursor's help page says: "For teams, Privacy Mode is enabled by default for all team members" (Cursor). Admins can enforce it from the dashboard so members can't turn it off. Cursor's governance docs say the narrower thing, that Privacy Mode "is on by default for Enterprise teams" (Cursor).

For individual accounts, Cursor's pages don't give a default. The security page says only that Privacy Mode "is available to anyone (free or Pro)" (Cursor). A user on Cursor's forum reported in June 2025 that a Free account started on "Share Data" and asked what the other plans default to, and the thread has no answer from Cursor (Cursor forum).

So check it yourself. Press Cmd+Shift+J on a Mac or Ctrl+Shift+J on Windows or Linux to open Cursor Settings, click General, and turn on Privacy Mode (Cursor). If you use a personal account on a work laptop, Cursor's governance docs suggest companies block exactly that with an "Allowed Team IDs" policy, because personal accounts "might not have Privacy Mode enabled."

Does Cursor train on your code?

Only with Privacy Mode off. Cursor's data use page, updated September 3, 2026, says that with Privacy Mode off, "we may use and store codebase data, prompts, editor actions, code snippets, and other code data and actions to improve our AI features and train our models" (Cursor). The same page says some inference providers may then "temporarily access and store model inputs and outputs," deleted after use.

The privacy policy reads differently at first. It says Anysphere doesn't train on your inputs or suggestions unless they're flagged for security review, you report them as feedback, or "you've explicitly agreed" (Cursor). Leaving Privacy Mode off is how Cursor treats that agreement, so the two pages don't conflict. Rating a suggestion counts as feedback, and Cursor says it may then "store the entire exchange."

How Cursor compares with 14 other AI apps on training is in which AI companies train on your data.

Which model providers see your code in Cursor?

Whichever model you pick, and Cursor too. Cursor's docs say it sends "prompts and code context to language model providers like OpenAI, Anthropic, and Google," and that its own models, such as Composer, may be processed by "our inference providers" (Cursor). The data use page lists SpaceXAI, OpenAI, Anthropic, and Meta as providers with their own retention policies (Cursor). The full subprocessor list is on Cursor's trust portal, which didn't load as readable text when we tried on October 24, 2026.

With Privacy Mode on, Cursor says it "maintains zero data retention (ZDR) agreements with all providers" (Cursor). There are three gaps:

• Abuse flags. Providers, "including Cursor," may run risk classifiers, and a flagged prompt "may be stored for investigation" under that provider's retention rules.
• Models outside ZDR. Cursor names Claude Fable 5.1 and Claude Fable 5, whose inputs and outputs Anthropic stores for "automatic and human harm-prevention reviews" (Cursor). With Privacy Mode on, requests to them fail until an admin approves the retention policy for the whole team.
• Your own API key. "ZDR doesn't apply when you use your own API keys" (Cursor), and the request still goes "through our backend," where Cursor builds the final prompt (Cursor).

Zero data retention means the provider still reads your prompt to answer it and promises not to keep it. We explain the limits in what is zero data retention.

Does Cursor store your codebase?

Less than it used to. Until mid-2026, Cursor's semantic search uploaded your code to compute embeddings and kept those embeddings on its servers, and many third-party guides to Cursor privacy still describe it that way. On July 21, 2026, a Cursor staff member wrote on its forum that "Cursor no longer needs to build a semantic index of your codebase which means we're no longer computing embeddings of your code or storing them on our servers for search" (Cursor forum). Cursor's search docs now say its Instant Grep index is built on your machine and that "Cursor does not upload file paths or code to build a search index" (Cursor docs).

Files the agent opens can still be sent with the model request. Cursor also caches file contents on its servers to save time, encrypted with keys that "only exist on our servers for the duration of a request," and says the cache is "never permanently stored" (Cursor).

Do Cursor's cloud agents keep your code?

Yes, while they run, and their transcripts for good unless you delete them. Cursor's docs call cloud agents "the only feature that requires Cursor to store code" (Cursor). They run in isolated virtual machines in an AWS account kept apart from the rest of Cursor's production systems (Cursor docs), and your code "is stored on VM disks while the agent is accessible" (Cursor docs).

Retention is longer than the governance page's "deleted after the agent completes" suggests. The cloud agent docs say conversation history "is kept indefinitely by default," and environment snapshots, which can include a clone of your repo, last until 30 days of inactivity and "can't be deleted on demand" (Cursor docs). The Delete Agent API removes a transcript. Enterprise admins can cap transcripts at 90 days.

This is where "Privacy Mode (Legacy)" still shows up. Cursor says the legacy mode "blocks cloud data storage," so cloud agents don't work with it, and you have to switch to the current Privacy Mode, which allows storage but not training (Cursor docs). Cloud agents come with Premium and higher, Teams, and Enterprise, not Free or Plus (Cursor docs).

Is Cursor safe for company code?

It has the certifications a security review usually checks for. As of its August 25, 2026 security page, Cursor holds AIUC-1, ISO/IEC 27001:2022, and ISO/IEC 42001:2023 certifications and a SOC 2 Type II attestation, and commits to penetration testing at least once a year (Cursor). It says it uses no infrastructure in China and no China-headquartered subprocessors. Enterprise customers can add their own encryption keys for cloud agent data and keep inference and storage in the US (Cursor).

Ownership changed this year. Cursor announced on August 14, 2026 that it "has officially been acquired by SpaceX," completing a process that began with a SpaceXAI partnership in April (Cursor). Its plans are now sold "through X Subscription Corp," and the $8 Plus plan includes only Grok models (Cursor). The privacy policy lets Anysphere share personal data with affiliates, meaning companies under common control (Cursor), and Cursor's help page says Grok Bot "runs on a separate product surface with its own data flows" from the editor's Privacy Mode (Cursor).

Cursor privacy in 2026: a timeline

How Morse keeps a private question about your code private

Every gap above comes from the same place: your prompt and your code pass through a company's servers, under an account, and what happens next depends on a toggle, a contract with each provider, and which model you picked. Morse isn't a code editor. For the questions you'd rather not run through your editor's account, such as a stack trace with a customer's data in it or a snippet from a project you can't name, Morse is built so the toggle doesn't exist. The Free plan includes coding, file, and other chat tools.

• Private, for code you'd rather no host keep. New chats start in Private. Open-weight models like DeepSeek, Kimi, and GLM, plus Grok, run under Morse's zero data retention agreements with its inference, search, and other providers. Where a provider confirms zero retention on each reply, Morse checks it and refuses a reply that doesn't.
• E2EE, for code no one should read. Your browser checks the enclave's hardware attestation before anything leaves your device, then encrypts the message so only that enclave can read it. Morse's servers relay text they can't read. This rests on the enclave hardware and attestation working as designed. E2EE chats come with Pro, at $19 a month.
• Anonymous, for GPT, Claude, and Gemini without your account attached. Morse's proxy removes your account, email, and IP address and sends the message under Morse's own account. The provider sees the message without knowing it's you and may keep it for a limited time to check for abuse, under its own policy, so strip keys and names from the snippet first.

In every mode, your chat history is stored in your browser, encrypted, not on Morse's servers, so there's no transcript kept indefinitely and no snapshot waiting out a 30-day window. Morse doesn't train AI on your content, sell your data, or show ads (Morse privacy policy). Attached files are sent with the message and never stored by Morse. Clearing your browser or deleting your account removes your chats for good, and Morse can't recover them either, so keep what you need. For how this compares with other chat apps, see are AI chats private.

So is Cursor private enough for you?

• Training: turn on Privacy Mode in Settings > General and check it after every new install or account switch. Morse doesn't train on your chats, so there's nothing to turn on.
• Provider retention: avoid models Cursor marks as outside ZDR, and remember your own API key drops ZDR. Morse's Private mode runs under zero data retention agreements.
• Stored code: skip cloud agents for anything that can't sit on Cursor's servers, or delete transcripts with the Delete Agent API. Morse keeps your history only in your browser.
• Secrets: keep them out of prompts in any tool. In Morse's E2EE mode, Morse's servers can't read the message at all.

You can start free with no card, or send a first message from the Morse home page without an account.