# Concerns about Privacy Mode and Data Storage **URL:** \ **Category:** Discussions\ **Created:** [May 30, 2024, 6:17am UTC](https://forum.cursor.com/t/concerns-about-privacy-mode-and-data-storage/5418 "2024-05-30T06:17:04Z")\ **Posts on this page:** 17\ **Page:** 1
**Author:** ![khaismile1997](https://sea3.discourse-cdn.com/cursor1/user_avatar/forum.cursor.com/khaismile1997/32/2149_2.png) [@khaismile1997](https://forum.cursor.com/u/khaismile1997)\ **Post date:** [May 30, 2024, 6:17am UTC](https://forum.cursor.com/t/concerns-about-privacy-mode-and-data-storage/5418/1 "2024-05-30T06:17:04Z")
Hi everyone, I’m currently using Cursor.sh to assist with my development work on a client project. My client has raised concerns about potential NDA violations and data protection, even though I’ve been using Privacy Mode to prevent data collection. Specifically, my client wants assurance that enabling Privacy Mode ensures that no data is saved or stored in Cursor.sh’s database when scanning files on my local computer. I’ve reached out to the Cursor.sh team for documentation or evidence to verify this, but I was wondering if anyone here has dealt with similar concerns or has any insights. Have any of you had to prove to your clients that Privacy Mode effectively prevents data storage? How did you go about getting this assurance? Any documentation, experiences, or advice would be greatly appreciated. Thank you in advance for your help! ---
**Author:** ![kinopee](https://sea3.discourse-cdn.com/cursor1/user_avatar/forum.cursor.com/kinopee/32/1794_2.png) [@kinopee](https://forum.cursor.com/u/kinopee)\ **Post date:** [May 30, 2024, 8:18am UTC](https://forum.cursor.com/t/concerns-about-privacy-mode-and-data-storage/5418/2 "2024-05-30T08:18:41Z")
You can read a new page on privacy. Click [Full Policy] toggle. > **[Terms of Service | Cursor - The AI-first Code Editor](https://cursor.sh/privacy)** > > Cursor is the IDE of the future, built for pair-programming with Powerful AI. In addition, Business plan includes OpenAI’s zero-data retention policy. > OpenAI’s zero-data retention policy refers to a practice where OpenAI does not retain any personal data or conversation history provided by users through its services. This policy ensures that: > > 1. **No Data Storage** : Any data sent to OpenAI’s servers is not stored permanently. Once the interaction is completed, the data is deleted and not saved in any database or storage system. > > 2. **Privacy Protection** : This policy enhances user privacy by ensuring that their information is not retained or accessible for future use. It minimizes the risk of data breaches and unauthorized access. > > 3. **Compliance** : It helps in complying with various privacy laws and regulations that require minimizing data retention and protecting user privacy. > > 4. **Security** : By not retaining data, OpenAI reduces potential security vulnerabilities associated with data storage. > > Overall, OpenAI’s zero-data retention policy is designed to protect user privacy and data security by ensuring that personal data is not stored or retained beyond the duration of the interaction. ---
**Author:** ![khaismile1997](https://sea3.discourse-cdn.com/cursor1/user_avatar/forum.cursor.com/khaismile1997/32/2149_2.png) [@khaismile1997](https://forum.cursor.com/u/khaismile1997)\ **Post date:** [June 4, 2024, 2:05pm UTC](https://forum.cursor.com/t/concerns-about-privacy-mode-and-data-storage/5418/3 "2024-06-04T14:05:31Z")
Thanks @kinopee but I need a piece of proper evidence to prove that when I turn privacy mode on, Cursor won’t store any of my code to the DB, your privacy page alone doesn’t convince my client enough 😢 ---
**Author:** ![wisher](https://sea3.discourse-cdn.com/cursor1/user_avatar/forum.cursor.com/wisher/32/3576_2.png) [@wisher](https://forum.cursor.com/u/wisher)\ **Post date:** [August 27, 2024, 9:36am UTC](https://forum.cursor.com/t/concerns-about-privacy-mode-and-data-storage/5418/5 "2024-08-27T09:36:08Z")
This is a privacy hell. Under no circumstances, you are okay using cursor without getting your client’s okay. Not only they will pass the prompt to other servers, they will also use their servers to proxy and you cannot guarantee data residency will be honoured. This is the major limitation of Cursor. I doubt anyone in the EU and doing any kind of business with customer data can use this. ---
**Author:** ![litecode](https://sea3.discourse-cdn.com/cursor1/user_avatar/forum.cursor.com/litecode/32/2966_2.png) [@litecode](https://forum.cursor.com/u/litecode)\ **Post date:** [August 27, 2024, 10:43am UTC](https://forum.cursor.com/t/concerns-about-privacy-mode-and-data-storage/5418/6 "2024-08-27T10:43:16Z")
Just adding the recent tl;dr version of the privacy policy at: [https://www.cursor.com/privacy](https://www.cursor.com/privacy) > TLDR > > - If you enable “Privacy Mode” in Cursor’s settings, none of your code will ever be stored by us or any third-party (except for OpenAI and Anthropic, which persist the prompts we send to them for 30 days for trust and safety. Business plan users’ data will not be retained at all by OpenAI or Anthropic.) > > - If you choose to keep Privacy Mode off, we may save prompts / collect telemetry data to improve the product. If you use autocomplete, [Fireworks](https://fireworks.ai/) (our inference provider) may also collect prompts to improve inference speed. > > ### Other notes > > - Even if you use your API key, your requests will still go through our backend! That’s where we do our final prompt building. > > - If you choose to index your codebase, Cursor will upload your codebase in small chunks to our server to compute embeddings, but all plaintext code ceases to exist after the life of the request. The embeddings and metadata about your codebase (hashes, file names) may be stored in our database, but none of your code is. ![IMG_2276](https://us1.discourse-cdn.com/cursor1/original/2X/3/3d1bc561f398486edb3599a635c70f817f679c37.jpeg) I don’t get the sense that the Cursor team are ‘bad guys’, they always seem to be open and transparent about what they are building, how they are doing it, and how their services work, but for their benefit, and that of users, I’d love to see a published checklist of business security ‘must haves’ to facilitate adoption and onboarding and save everyone’s time when having related discussions. To be honest, I find even the big players aren’t very good with explaining their security practices ‘precisely’, I’ve already had too many discussions essentially speculating on what, exactly, is occurring, because the docs aren’t clear enough. ---
**Author:** ![msc](https://avatars.discourse-cdn.com/v4/letter/m/f6c823/32.png) [@msc](https://forum.cursor.com/u/msc)\ **Post date:** [August 27, 2024, 1:46pm UTC](https://forum.cursor.com/t/concerns-about-privacy-mode-and-data-storage/5418/7 "2024-08-27T13:46:10Z")
I’m interested in the Enterprise package is they get Claude back on line. ---
**Author:** ![HeyHey](https://avatars.discourse-cdn.com/v4/letter/h/cdc98d/32.png) [@HeyHey](https://forum.cursor.com/u/HeyHey)\ **Post date:** [August 27, 2024, 4:39pm UTC](https://forum.cursor.com/t/concerns-about-privacy-mode-and-data-storage/5418/8 "2024-08-27T16:39:42Z")
One of the questions I have is if there is a way to remove the index / embeddings on the server? I know there is the delete index option in the editor, but this does not delete the embedding on the server (the resync happens immediately). Was also wondering what happens when I delete my account in the profile settings. Do the embeddings then get removed from the server? ---
**Author:** ![geocine](https://sea3.discourse-cdn.com/cursor1/user_avatar/forum.cursor.com/geocine/32/4283_2.png) [@geocine](https://forum.cursor.com/u/geocine)\ **Post date:** [September 8, 2024, 5:39pm UTC](https://forum.cursor.com/t/concerns-about-privacy-mode-and-data-storage/5418/9 "2024-09-08T17:39:25Z")
Did this change, does anyone know they removed the clause > (except for OpenAI and Anthropic, which persist the prompts we send to them for 30 days for trust and safety. Business plan users’ data will not be revealed at all by OpenAI or Anthropic.) ![image](https://us1.discourse-cdn.com/cursor1/original/2X/d/d14806a1938a98f866253407f832a7205bd23e83.png) ---
**Author:** ![arvid220u](https://sea3.discourse-cdn.com/cursor1/user_avatar/forum.cursor.com/arvid220u/32/82089_2.png) [@arvid220u](https://forum.cursor.com/u/arvid220u)\ **Post date:** [September 10, 2024, 2:40am UTC](https://forum.cursor.com/t/concerns-about-privacy-mode-and-data-storage/5418/10 "2024-09-10T02:40:09Z")
Correct! Zero data retention with OpenAI and Anthropic is now available for all users that have privacy mode enabled, regardless of whether on the business plan or not. ---
**Author:** ![geocine](https://sea3.discourse-cdn.com/cursor1/user_avatar/forum.cursor.com/geocine/32/4283_2.png) [@geocine](https://forum.cursor.com/u/geocine)\ **Post date:** [September 10, 2024, 2:30pm UTC](https://forum.cursor.com/t/concerns-about-privacy-mode-and-data-storage/5418/11 "2024-09-10T14:30:39Z")
Is it possible to update this as well. Seems like it is still exclusive to business ![image](https://us1.discourse-cdn.com/cursor1/original/2X/9/9073211836503ff2a026641490ba93bb04b17746.png) ---
**Author:** ![msc](https://avatars.discourse-cdn.com/v4/letter/m/f6c823/32.png) [@msc](https://forum.cursor.com/u/msc)\ **Post date:** [September 11, 2024, 12:52am UTC](https://forum.cursor.com/t/concerns-about-privacy-mode-and-data-storage/5418/12 "2024-09-11T00:52:23Z")
You have to have more than one users , so at least 2 people for $80 per month ---
**Author:** ![sascha](https://sea3.discourse-cdn.com/cursor1/user_avatar/forum.cursor.com/sascha/32/4542_2.png) [@sascha](https://forum.cursor.com/u/sascha)\ **Post date:** [September 19, 2024, 4:23am UTC](https://forum.cursor.com/t/concerns-about-privacy-mode-and-data-storage/5418/13 "2024-09-19T04:23:17Z")
It comes with the free tier: ![2024-09-19 12_21_11-main.py - skeletoror - Cursor](https://us1.discourse-cdn.com/cursor1/original/2X/0/06191beee0c8739afd22556d4b8eb652a7dc0af2.png) ---
**Author:** ![kinopee](https://sea3.discourse-cdn.com/cursor1/user_avatar/forum.cursor.com/kinopee/32/1794_2.png) [@kinopee](https://forum.cursor.com/u/kinopee)\ **Post date:** [October 16, 2024, 9:51pm UTC](https://forum.cursor.com/t/concerns-about-privacy-mode-and-data-storage/5418/14 "2024-10-16T21:51:11Z")
Don’t forget the fact that Cursor is SOC 2 Certified. ![CleanShot 2024-10-17 at 06.48.16](https://us1.discourse-cdn.com/cursor1/original/2X/c/ca43f790b7c454e54a585dfb472b0c82f285fd1e.png) ---
**Author:** ![aaa](https://avatars.discourse-cdn.com/v4/letter/a/ea666f/32.png) [@aaa](https://forum.cursor.com/u/aaa)\ **Post date:** [November 24, 2024, 1:12am UTC](https://forum.cursor.com/t/concerns-about-privacy-mode-and-data-storage/5418/15 "2024-11-24T01:12:50Z")
The computed embeddings from your code is stored on Cursor servers and contain a lot of information bits about your code. They currently don’t seem to address the concerns and think these embeddings are not their customer’s data. That is problematic and they need to fix it and give more control over it to their customers. Here is the section from their current privacy policy ([Privacy Policy | Cursor - The AI-first Code Editor](https://www.cursor.com/privacy)): > If you choose to index your codebase, Cursor will upload your codebase in small chunks to our server to compute embeddings, but all plaintext code ceases to exist after the life of the request. The embeddings and metadata about your codebase (hashes, file names) may be stored in our database, but none of your code is. Until they do so, this is not really enterprise ready. Here are some more questions that need clarification before our security folks can allow its usage at work: - [Privacy Policy needs more clarification about how the content is handled and used](https://forum.cursor.com/t/privacy-policy-needs-more-clarification-about-how-the-content-is-handled-and-used/12483) That said, they have done a very good job on the security side, their explanation of their security story is one of the best I have seen. - [Security | Cursor - The AI-first Code Editor](https://www.cursor.com/security) ---
**Author:** ![FinDevAI](https://sea3.discourse-cdn.com/cursor1/user_avatar/forum.cursor.com/findevai/32/89390_2.png) [@FinDevAI](https://forum.cursor.com/u/FinDevAI)\ **Post date:** [November 24, 2024, 1:59am UTC](https://forum.cursor.com/t/concerns-about-privacy-mode-and-data-storage/5418/16 "2024-11-24T01:59:28Z")
Expectations of privacy are just that. You especially have to wonder about OpenAI, not only strange was the string of senoir leadership that quit earlier this fall, and Sam’s weird identity crisis as the leader, but also the former head of the NSA joined the OpenAI board of directors. When sending anything to Anthropic, or OpenAI, I think you can be assured no matter what their respective corporate policy says it is, I ma certain your prompts become property of the NSA. Unless you are writing rules for deep packet DNS inspection, you won’t be affected by it. > **[Former head of NSA joins OpenAI board](https://www.theverge.com/2024/6/13/24178079/openai-board-paul-nakasone-nsa-safety)** > > Another new board member. ---
**Author:** ![aaa](https://avatars.discourse-cdn.com/v4/letter/a/ea666f/32.png) [@aaa](https://forum.cursor.com/u/aaa)\ **Post date:** [November 24, 2024, 2:12am UTC](https://forum.cursor.com/t/concerns-about-privacy-mode-and-data-storage/5418/17 "2024-11-24T02:12:19Z")
The calls to the model APIs is less concerning. For enterprises usage, you can use the Azure version of OpenAI models, or Google Cloud VertexAI version of Google models and Antrhopic models, which come with top-level security and data handing protections. - [Azure OpenAI Service documentation - Quickstarts, Tutorials, API Reference - Azure AI services | Microsoft Learn](https://learn.microsoft.com/en-us/azure/ai-services/openai) - [https://cloud.google.com/vertex-ai/generative-ai/docs/partner-models/use-claude](https://cloud.google.com/vertex-ai/generative-ai/docs/partner-models/use-claude) - [Azure OpenAI, including GPT-4o, Approved as a Service within the FedRAMP High Authorization for Azure Government - Azure Government](https://devblogs.microsoft.com/azuregov/azure-openai-fedramp-high-for-government/) That should be good enough for most enterprise customers for that part. ---
**Author:** ![system](https://sea3.discourse-cdn.com/cursor1/user_avatar/forum.cursor.com/system/32/99069_2.png) [@system](https://forum.cursor.com/u/system)\ **Post date:** [June 18, 2026, 10:19am UTC](https://forum.cursor.com/t/concerns-about-privacy-mode-and-data-storage/5418/19 "2026-06-18T10:19:57Z")