Privacy Policy — September 29, 2026

Use & Processing · Context

Policy covers personal data practices for Anysphere's software, platform, APIs, Documentation and related tools

Anysphere, Inc. says this Privacy Policy explains how it collects, uses, discloses and processes your personal data when you use its software, platform, APIs, Documentation and related tools, including the cursor.com website and related software it makes available to build, deploy, host and manage software projects. The policy calls all of this the "Service".

Supporting quotations

explains how we collect, use, disclose, and process your personal data when you use Anysphere's software, platform, APIs, Documentation, and related tools

and all related software made available by Anysphere to build, deploy, host, and manage software projects

Qualifications & exceptions

• Applies when you use the Service as the policy defines it.
• The policy does not apply where Anysphere acts as a data processor for commercial customers (see the processor exclusion).

Not stated here

• The policy does not list individual Anysphere products or say which of them fall within "related tools" or "related software".

Use & Processing · Company practice

Personal data may be used to provide the Service and to administer your account, including payments

Anysphere says it may use personal data to provide and maintain the Service, including optional features that enhance functionality and user experience, and to create, manage and administer your account, including facilitating payments and responding to inquiries. The Service here means the software, platform, APIs, Documentation and related tools the policy defines in its introduction.

Supporting quotations

We may use personal data for the following purposes:

To provide and maintain the Service, including optional features that enhance functionality and user experience.

To create, manage, and administer your account, including facilitating payments and responding to inquiries.

Anysphere's software, platform, APIs, Documentation, and related tools

Qualifications & exceptions

• Stated as purposes for which Anysphere "may" use personal data, not a promise to use data only for these purposes.
• Account administration includes facilitating payments and responding to inquiries.

Not stated here

• The policy does not say which optional features are meant or which personal data each purpose uses.

Use & Processing · Company practice

Personal data may be used to improve and develop the Service and conduct research

Anysphere says it may use personal data to improve and develop the Service and to conduct research, including debugging and identifying or repairing issues that impair functionality.

Supporting quotations

To improve and develop the Service and conduct research, including debugging and identifying or repairing issues that impair functionality.

Qualifications & exceptions

• Stated as something Anysphere "may" do.
• Debugging and repairing functionality issues are given as inclusions, not limits.

Not stated here

• The policy does not say what research is meant or who conducts it, or which personal data are used.
• This purpose is separate from the model-training rule, which treats Inputs and Suggestions differently.

Use & Processing · Company practice

Personal data may be used to communicate with you, and cookies may be used to market additional products

Anysphere says it may use personal data to communicate with you, including sending updates, information about the Service and events. Separately, in the section on cookies, it says cookies and similar technologies help it market additional products or services to you. The list of purposes in this section does not itself say marketing.

Supporting quotations

To communicate with you, including sending updates, information about the Service, and events.

market additional products or services to you

Qualifications & exceptions

• Communications named: updates, information about the Service, and events.
• Marketing of additional products or services is mentioned in the cookies description in section 1, not in this list.

Not stated here

• The policy does not say whether you can opt out of these communications or of cookie-based marketing; the Cookie Policy is linked but not supplied.
• The policy does not say how the cookie-based marketing statement relates to this list of purposes.

Cross-references

• refers to (model-proposed): Cookies and similar technologies are used to operate the Service, personalize it and market additional products — The marketing purpose in the communicate card comes from the cookies description in section 1.

Use & Processing · Company commitment

Anysphere says it does not train models on Inputs or Suggestions, or let third parties, except in three cases

Anysphere states that it does not use Inputs or Suggestions to train its models, or permit third parties to use them for training, unless one of three listed conditions applies. The statement is limited to Inputs and Suggestions; it does not speak in this sentence to other personal data, and the note at the top of the policy refers readers to a separate Privacy Overview for training information.

Supporting quotations

We do not use Inputs or Suggestions to train our models, or permit third parties to use them for training, unless

Qualifications & exceptions

• Covers Inputs and Suggestions only.
• Covers use by Anysphere and use by third parties it permits.
• Subject to the three conditions in the next card.

Not stated here

• The Privacy Overview is not part of this document, so what it says about training information is unknown.
• The policy does not say whether other personal data, such as usage data, are used for training.

Cross-references

• qualifies (model-proposed): Personal data may be disclosed to service providers and business partners, including model and payment providers — The no-training statement also bars third parties from using Inputs and Suggestions for training, subject to the three conditions, which narrows what model and other providers may do with such data.
• referred to by (model-proposed): Model training information and choices are described in a separate Privacy Overview — The note at the top points to a separate Privacy Overview for training information, while section 2 states the no-training rule for Inputs and Suggestions. The policy does not say how the two relate.
• has exception (model-proposed): Inputs and Suggestions may be used for training if flagged for security review, reported to Anysphere, or you agree — The three conditions in the exceptions card are the "unless" cases of the no-training statement.

Use & Processing · Restriction or exception

Inputs and Suggestions may be used for training if flagged for security review, reported to Anysphere, or you agree

The no-training statement does not apply to Inputs and Suggestions in three cases. (1) They are flagged for security review, in which case Anysphere says it may analyze them to improve its ability to detect and enforce its Terms of Service. (2) You explicitly report them to Anysphere, for example as Feedback. (3) You have explicitly agreed to their use for such training purposes.

Supporting quotations

(1) they are flagged for security review (in which case we may analyze them to improve our ability to detect and enforce our Terms of Service)

(2) you explicitly report them to us (for example, as Feedback)

(3) you’ve explicitly agreed to their use for such training purposes.

Qualifications & exceptions

• Exception (1): flagged for security review; stated purpose is improving detection and enforcement of the Terms of Service.
• Exception (2): you explicitly report them, for example as Feedback.
• Exception (3): you have explicitly agreed to their use for such training purposes.

Not stated here

• The Terms of Service are linked but their text is not supplied here, so what the card cannot say includes what that document treats as a violation.
• The policy does not say who flags Inputs or Suggestions for security review, or what triggers a flag.
• Exception (1) says Anysphere "may analyze them to improve" its detection and enforcement ability; the text does not say whether that analysis counts as training or is limited to those stated purposes.
• The policy does not say how explicit agreement under exception (3) is given or recorded.

Cross-references

• exception to (model-proposed): Anysphere says it does not train models on Inputs or Suggestions, or let third parties, except in three cases — The three conditions in the exceptions card are the "unless" cases of the no-training statement.
• referred to by (model-proposed): If you give Feedback, Anysphere may store the entire exchange, and reported exchanges may be used for training — Exception (2) in section 2 names reporting Inputs and Suggestions to Anysphere "for example, as Feedback", which is the Feedback section 1 describes storing.

Use & Processing · User right or choice

The Service has instructions for managing your preferences on use of Inputs and Suggestions for training

Anysphere says you can find instructions in the Service on how to manage your preferences regarding the use of Inputs and Suggestions for training.

Supporting quotations

You can find instructions in the Service on how to manage your preferences regarding the use of Inputs and Suggestions for training.

Qualifications & exceptions

• The instructions are said to be inside the Service.

Not stated here

• The instructions are not part of this document, so what choices exist and whether they apply to all three exceptions is unknown.

Use & Processing · Permission or license

Personal data may be aggregated or de-identified and used for the same purposes

Anysphere says it may aggregate or de-identify personal data so that it no longer identifies you, and use that information for the purposes described above, such as analyzing how the Service is used, improving or adding features, and conducting research.

Supporting quotations

We may aggregate or de-identify personal data so that it no longer identifies you, and use that information for the purposes described above, such as analyzing how the Service is used, improving or adding features, and conducting research.

Qualifications & exceptions

• Applies to information that no longer identifies you.
• Purposes are those described above, with analysis, feature improvement and research as examples.

Not stated here

• The policy does not say how de-identification is performed or what standard it meets.

Cross-references

• referred to by (model-proposed): Data no longer needed is deleted, erased, de-identified or anonymized under procedures Anysphere and providers follow — Section 4 lists de-identification as an outcome when data is no longer needed, and section 2 says de-identified information may be used for the described purposes.

Use & Processing · Company commitment

Anysphere says it will keep de-identified information de-identified, except as required by law

Anysphere states that it will maintain de-identified information in its de-identified form and will not attempt to reidentify it, except as required by law.

Supporting quotations

We will maintain de-identified information in its de-identified form and will not attempt to reidentify it, except as required by law.

Qualifications & exceptions

• Exception: as required by law.

Not stated here

• The policy does not say whether the commitment extends to third parties that receive de-identified information.

Use & Processing · Company practice

Data is processed on servers in various jurisdictions, including the United States, with the same protections applied

Anysphere says it processes your personal data for the purposes described in the policy on servers located in various jurisdictions, including the United States. It says that although data protection laws vary by country, it applies the protections in this policy to your personal data regardless of where it is processed, and that it transfers data only in accordance with legally valid transfer mechanisms.

Supporting quotations

Anysphere processes your personal data for the purposes described in this Privacy Policy on servers located in various jurisdictions, including in the United States.

While data protection laws vary by country, we apply the protections outlined in this policy to your personal data regardless of where it is processed, and we only transfer data in accordance with legally valid transfer mechanisms.

Qualifications & exceptions

• Protections in the policy are applied regardless of where data is processed.
• Transfers are stated to follow legally valid transfer mechanisms.

Not stated here

• The jurisdictions other than the United States are not named.
• The transfer mechanisms are not named.

Use & Processing · Company practice

For EEA users, data may be transferred to the US and other countries, with adequate protection required

For users in the European Economic Area, the policy says personal data may be transferred to Anysphere's United States servers and to other countries outside the EEA and the UK. Where information is transferred outside the EEA or the UK, Anysphere says it requires an adequate level of data protection. The sentence about where the data may go reads "to our United States servers to other countries outside the EEA and the UK"; the text does not say whether the United States servers and the other countries are two destinations or one chain, and this card does not resolve that.

Supporting quotations

For users in the European Economic Area, (“EEA”), when you access our Service, your personal data may be transferred to our United States servers to other countries outside the EEA and the UK.

Where information is transferred outside the EEA or the UK, we require an adequate level of data protection.

Qualifications & exceptions

• Applies to users in the European Economic Area.
• Adequate level of protection is required where information is transferred outside the EEA or the UK.

Not stated here

• The wording "to our United States servers to other countries outside the EEA and the UK" is ambiguous as quoted.
• The policy does not say how an adequate level of data protection is determined or what is required.
• The policy does not state whether UK users are covered by a separate statement.