What is Cursor Privacy Mode?
Cursor Privacy Mode is a setting that keeps your code out of AI model training. Cursor's privacy help page puts it in one line: "Privacy Mode ensures your code is never used for training by Cursor or other AI model providers."
It does not stop your code from leaving your machine. Any AI feature has to send prompts and code context to a model, and Cursor says it sends them "to model providers like OpenAI, Anthropic, and Google." What Privacy Mode changes is what happens to that data afterwards: whether it can be stored and whether it can be used to train models.
What changes when Privacy Mode is on or off?
Cursor's Data Use and Privacy Overview describes both states.
| Privacy Mode on | Privacy Mode off | |
|---|---|---|
| Training by Cursor | "Customer Data will not be used for training by Cursor." | Cursor "may use and store codebase data, prompts, editor actions, code snippets, and other code data and actions to improve our AI features and train our models." |
| Model providers | Zero data retention (ZDR) agreements: providers "will not store or train on your data." | Some inference providers "may temporarily access and store model inputs and outputs to improve our inference performance; this data is deleted after use." |
| Abuse checks | Providers may run risk classifiers; flagged data "may be stored for investigation and deleted in accordance with their retention policies." | Provider policies apply |
Two other notes on the same page apply either way. First, "Even if you use your API key, your requests will still go through our backend! That's where we do our final prompt building." Second, Cursor caches file contents to reduce latency: "The files are encrypted using unique client-generated keys, and these encryption keys only exist on our servers for the duration of a request. All cached file contents are temporary, never permanently stored, and never used as training data when privacy mode is enabled."
How do you turn on Privacy Mode?
From the help center:
- Open Cursor Settings with Cmd+Shift+J on Mac or Ctrl+Shift+J on Windows and Linux.
- Click General in the sidebar.
- Toggle Privacy Mode on.
On individual plans this is your choice; Cursor's enterprise overview lists Privacy Mode as "User choice" for individual plans and "Enforce org-wide" for Teams and Enterprise. Cursor's help center says that for teams, Privacy Mode "is enabled by default for all team members," and the enterprise docs say it "is on by default for Enterprise teams."
The setting covers more than the editor. Cursor's deployment docs say Privacy Mode "applies equally" to the desktop app and the standalone CLI, and the Cloud Agents security docs say Cloud Agents run in Privacy Mode.
What data does Cursor keep with Privacy Mode on?
Mostly nothing beyond the request, with a few documented exceptions.
Cloud Agents. Cursor's privacy and data governance docs say "Cloud Agents are the only feature that requires Cursor to store code." They keep "Encrypted copies of repositories that Cloud Agents work on," stored temporarily while the agent runs and deleted after it completes. If your policy forbids code storage, Cursor's advice is not to enable Cloud Agents.
Cloud Agents also keep two kinds of run data, per the Cloud Agent network and retention docs:
- Conversation history (prompts, responses, tool calls, artifacts) "is kept indefinitely by default." You can remove it with the Delete Agent API.
- Environment snapshots "are stored for a maximum of 30 days of inactivity," and are deleted automatically once unused for 30 days. They can't be deleted on demand.
Custom retention windows for Cloud Agents are in early access for select Enterprise teams, with Indefinite and 90 days as the options.
Code search. Cursor's search docs say Instant Grep "builds and queries its index on your machine. Cursor does not upload file paths or code to build a search index, and it does not store embeddings of your codebase for search." Files the agent opens can still go into model requests.
Abuse detection. As above, flagged prompts may be kept by a provider for investigation under that provider's policy.
What are the exceptions to zero data retention?
Privacy Mode does not cover everything. These are the documented gaps.
- Your own API keys. "ZDR doesn't apply when you use your own API keys. In that case, your data handling follows your provider's privacy policy."
- Models that require provider retention. "Some models also require data retention with their provider and fall outside Cursor's ZDR agreements. These models are off by default and require admin approval before use." Cursor names Claude Fable 5.1 and Claude Fable 5: Anthropic stores their inputs and outputs "to run automatic and human harm-prevention reviews," and "This data is not used for training or product improvement." With Privacy Mode on, requests to these models fail until the retention policy is approved in the dashboard, and opting in applies to the whole team.
- Cyber-verified models. Cursor's cyber safeguards page says that when you use a model with cyber safeguards off, "Privacy Mode is off for that model only." Other models in the same conversation keep your normal setting.
- Grok Bot. Cursor's help center says Grok Bot "runs on a separate product surface with its own data flows," so check its own docs.
If you rely on Privacy Mode for compliance, review the models list with these exceptions in mind before you approve a new model.
How do admins enforce Privacy Mode for a team?
Per Cursor's privacy and data governance docs:
- Go to your team dashboard at cursor.com/dashboard.
- Navigate to Settings.
- Enable Privacy Mode for the team.
- Optionally enforce it so members can't disable it.
Enforcement on its own does not stop someone from signing in to a personal account on a work laptop. For that, Cursor recommends the Allowed Team IDs MDM policy, which "prevents users from logging into personal accounts (which might not have Privacy Mode enabled) on corporate devices."
Cursor's pricing docs list "team-wide privacy mode enforcement" and "custom Chat data retention" among Teams plan features. See Cursor pricing for plan details.
Cloud Agents add one rule: "Legacy Privacy Mode is not supported for Cloud Agents, because agents need to store code and environment data in the cloud while they run." Cursor's advice is to enforce standard Privacy Mode org-wide so every run inherits its zero data retention guarantees. Read our Cursor Cloud Agents guide before turning them on for a regulated team.
What else protects your code in Cursor?
Privacy Mode is about training and retention. Other controls cover different risks:
- Encryption. Cursor encrypts data with TLS 1.2+ in transit and AES-256 at rest, and Enterprise customers can use Customer Managed Encryption Keys (CMEK) for Cloud Agent data.
- Data residency. US-only data residency for inference, processing and storage is available to Enterprise customers per team, as described in the same governance docs.
- Ignore files. A
.cursorignorefile blocks listed files from Agent, Tab and @ mentions, though Cursor notes the terminal and MCP tools the agent uses can't block them. Our Cursor ignore guide explains what it covers. - Rules. Project rules can tell the agent what not to touch, though Cursor notes rules are suggestions, not guarantees. See Cursor rules.
Keep your reusable prompts somewhere you control
Privacy Mode governs what happens to the code you send. The prompts and skills you write for Cursor are your own work too. Kipt keeps prompts and Agent Skills as Markdown in a private GitHub repo you own, so they stay under your account's access rules rather than inside any one editor.