Data Retention in the Business Plan

[litecode]

I recently referenced Cursor’s current tl;dr privacy policy in this post:

Concerns about Privacy Mode and Data Storage

Just adding the recent tl;dr version of the privacy policy at: https://www.cursor.com/privacy TLDR If you enable “Privacy Mode” in Cursor’s settings, none of your code will ever be stored by us or any third-party (except for OpenAI and Anthropic, which persist the prompts we send to them for 30 days for trust and safety. Business plan users’ data will not be retained at all by OpenAI or Anthropic.) If you choose to keep Privacy Mode off, we may save prompts / collect telemetry data to i…

And I often wonder what the relationship is between these settings and actions:

01) Privacy Mode Enabled (which I toggle ON)

02) Codebase Indexing (which I also toggle ON)

Is item 01 negated/overridden if I enable item 02?

My, possibly incorrect, understanding after writing this post is that:

• Item 02 does not negate item 01

• Item 02 does involve storing the vector embeddings of your code in a vector database but not the code itself

I’m still not sure why the vector embeddings aren’t considered as important as the code - aren’t they just multidimensional numerical representations of the code text, and therefore could be ‘un-embedded’ by using the same embedding model that was used to embed them?

I googled this:

Can vector embeddings be converted back?

And it led to things like:

• One OpenAI user’s guess about how embeddings work

• Another OpenAI user’s reference to a paper that seemingly shows that vector embeddings can be inverted

• Microsoft’s article on What are Vector Embeddings?

I’ll leave it to someone with more knowledge than me to provide an authoritative answer .

In regard to your question about enforcing Privacy Mode, I am a Pro user and I can toggle that setting on or off, so I am assuming the Business plan enables admins to enforce this setting for all their users.

Links for additional reference:

For better and more accurate codebase answers…you can index your codebase. Behind the scenes, Cursor computes embeddings for each file in your codebase, and will use these to improve the accuracy of your codebase answers.

https://docs.cursor.com/context/codebase-indexing

Does indexing the codebase require storing code?

It does not! If you choose to index your codebase, Cursor will upload your codebase in small chunks to our server to compute embeddings, but all plaintext code ceases to exist after the life of the request.

The embeddings and metadata about your codebase (hashes, file names) are stored in our database, but none of your code is.

https://docs.cursor.com/miscellaneous/privacy#does-indexing-the-codebase-require-storing-code

With Privacy Mode, none of your code will ever be stored by us or any third-party (except for OpenAI which persists the prompts we send to them for 30 days for trust and safety, unless you’re on the business plan). Otherwise, we may save prompts / collect telemetry data to improve Cursor.

https://docs.cursor.com/miscellaneous/privacy#what-is-privacy-mode

Posts for additional reference:

Need more information about data security

Hey! If you have privacy mode turned on, none of your data will be stored by us; we’re just a passthrough to the models. Yep you can send us a note at hi@cursor.sh if its necessary.

The difference between “Private Data Controls” and “Enterprise data security”

For our enterprise users, OpenAI will go further than their normal data guarantees and will also offer zero-day retention (i.e. none of your code is stored by them for any time).

Codebase Indexing

The vector DB will always be remote, though again no code is stored in it (if you turn on local mode, none of your code will be stored at-rest by us). Here’s how you can turn off indexing. I like this!

Codebase indexing VS chat with codebase

Yep! You can chat with codebase whether or not you index the codebase. If you don’t use indexing, we fall back on a simpler, entirely-local, and worse method for figuring out what parts of the codebase to show GPT-4 to answer your codebase-wide question.

Codebase indexing VS chat with codebase

We split it into syntactically relevant chunks (using tree-sitter), then store the embeddings in our vector database, while never storing any of your code on our servers. We use the local state of your codebase as the source of truth for the text corresponding to a given vector in the database.

Codebase Indexing

Hey! The codebase indexing feature works by: Chunking your codebase into small pieces locally Sending each piece to our server which then embeds the code (either with OpenAI’s embedding API or by a custom embedding model) The embeddings are stored in a remote vector DB, along with starting / ending line numbers and the relative path to that file. None of your code is stored in our databases. It’s gone after the life of the request. You can turn off codebase indexing by going into settings (g…

Document Q&A for security & compliance concerns for business use cases

Hey! Thanks for the kind words. Re Question 1: If you’re maximally security focused, the two settings to toggle are “Local/Privacy Mode” (hit the gear in the top right) and “Indexing new repos by default” (More tab on the right bar and then click into settings). Details on each: When turned on, Privacy Mode will ensure that absolutely no code data is stored on our servers. If you turn off indexing by default, then we won’t compute embeddings over new codebases you open (the embedding step req…