Cursor

Cursor documents no export of the agent (conversations, account-held user rules, automation memories). The only documented export is a profile export, which excludes user and team rules. The only runtime that accepts Cursor state is the Cursor client, and it depends on Cursor's backend, which does the final prompt building for every request.

• Cursor help: Rules (storage, profile exports)
• Cursor Data Use

No complete export exists. Chat history, account-stored user rules, cloud agent/automation memories and integration grants (GitHub app, Slack) stay with Cursor or in undocumented local stores. Several classes of state are missing.

• Cursor help: Rules
• Cursor docs: Automations (Memories)

Requests go through Cursor's backend even with the owner's own API key, and Tab uses only Cursor models. The Terms grant only a 'limited right to access and use the Service', which Anysphere may suspend or discontinue at any time without notice.

• Cursor Data Use
• Cursor help: Bring your own API key
• Cursor Terms of Service

Owners can add keys for OpenAI, Anthropic, Google, Azure and Bedrock, and an OpenAI-compatible base-URL override is mentioned. However, custom keys 'only work with chat models' (Tab stays on Cursor models). Because requests are routed through Cursor's backend, a local open-weight model has no documented official path.

• Cursor help: Bring your own API key
• Cursor docs: Privacy and Data Governance (base URL override)

Project files, project rules, hooks and local chat history remain on the owner's device. However, the Terms say that on termination Anysphere 'may at our option delete any Content or other data associated with your account', and they give no post-termination export window, so account-held state (user rules, cloud agent and automation data) can be lost.

• Cursor Terms of Service (sections 9-10)
• Cursor help: Delete your account

Rules (.mdc/AGENTS.md), hooks.json, mcp.json, permissions.json and sandbox.json are documented, human-readable files. Conversation history and checkpoints are stored locally in formats with no published schema, and account-side state is readable only through Cursor's service.

• Cursor docs: Rules
• Cursor docs: Agent overview (checkpoints stored locally)
• Cursor docs: Hooks

Final prompt building happens on Cursor's backend, and no documented view exposes the assembled context or base prompt. On the model setting, Auto routing chooses the model per request, and on teams the default is to hide which model was used. No public evidence shows that individual owners can see the model Auto resolved to (G12).

• Cursor Data Use
• Cursor docs: Cursor Router

The Privacy Policy retains data 'only for as long as necessary' with periods that 'vary', which gives no bounded retention table. With Privacy Mode off, Cursor 'may use and store codebase data, prompts, editor actions, code snippets', and the owner cannot view that data item by item.

• Cursor Privacy Policy (section 4)
• Cursor Data Use

No evidence of paid placement was found. Provider defaults such as Auto routing and Cursor's own models can be replaced in the model picker, and the Cursor Marketplace is curated. No binding commitment against self-preferencing or paid placement was found, so the absence rests on no statement at all.

• Cursor docs: Cursor Router
• Cursor Terms of Service

The durable record consists of chat transcripts, plus hooks the owner must write themselves (hooks are 'fail-open by default'). No documented mechanism records provider-side automations (Bugbot, cloud automations) into an owner record, warns when recording fails, or guarantees no pruning. Under G12, at least two shortfalls apply.

• Cursor docs: Hooks
• Cursor docs: Automations

No integrity data (hash chain, signatures or checkpoints) is documented for conversation or action records.

• Cursor docs: Agent overview
• Cursor docs: Hooks

In the default Auto-review mode, sandboxed shell commands cannot write outside the workspace, and 'sensitive Cursor config files' are protected. Commands that cannot be sandboxed are passed to a model classifier that can allow them, and 'Run Everything' removes the sandbox, so the agent can reach its local record by one path.

• Cursor docs: Run Modes

The Cursor client and backend are closed. The public GitHub repository cursor/cursor contains only README, SECURITY.md and .github, and requests depend on Cursor's proprietary backend.

• github.com/cursor/cursor
• Cursor Data Use

The agent identity is the Cursor account. Cloud agents mint JWTs that are verified 'against Cursor's published JWKS', which makes them a provider-issued credential that the provider can revoke.

• Cursor docs: Cloud Agent identity

Checkpoints snapshot and restore files the agent changed, and project rules and hooks live in git-tracked .cursor/ files. User rules are held on the Cursor account without history. Settings changes are not attributed to owner or agent, and cloud state is not covered.

• Cursor docs: Agent overview (Checkpoints)
• Cursor help: Rules

Owners can add and edit user, project and AGENTS.md rules, skills and subagents. The base system prompt is assembled on Cursor's backend and cannot be replaced.

• Cursor docs: Rules
• Cursor Data Use

The documented persistent memory stores are rules, which are editable files or settings, and Automation memories, which 'can be viewed and edited from the tool configuration UI' and deleted. No other cross-session memory store is documented.

• Cursor docs: Automations (Memories)
• Cursor docs: Rules

Owners can add any MCP server through mcp.json without review. The docs do not show a documented setting to remove each built-in tool (for example terminal, web search or browser) from the IDE agent. Only hook scripts or approval settings can deny these tools.

• Cursor docs: MCP
• Cursor docs: Agent security

Run modes, sandbox networking and approval protections are owner-configurable, and 'Run Everything' disables them. However, 'Cursor's hardcoded security rules layer on top, so local files cannot weaken those protections'.

• Cursor docs: Run Modes

Anysphere 'may modify or discontinue all or any portion of the Service at any time ... without notice'. Prompt building is server-side, Auto routing is 'managed by Cursor' with a model pool that 'changes over time', and the CLI auto-updates by default.

• Cursor Terms of Service (section 10)
• Cursor docs: Cursor Router
• Cursor docs: CLI installation (updates)

.cursorignore, sandbox.json and CLI allow/deny tokens scope files, network and commands, and spend is treated as met under G11 because there is no payment capability. However, 'Terminal commands and MCP tools run outside of Cursor's file access controls' (a bypass path), and no owner control limits whom the agent takes instructions from. Run modes are described as 'best-effort guardrails rather than a hard security boundary'.

• Cursor help: Ignore files
• Cursor docs: Agent security
• Cursor docs: CLI permissions

Terminal commands, MCP calls and fetches can be gated through Allowlist mode. However, 'Agents can modify workspace files without approval, except for configuration files', and the default Auto-review mode lets a classifier decide what is sent to the owner for approval.

• Cursor docs: Agent security
• Cursor docs: Run Modes

A Stop button halts the foreground agent. Cloud agents and automations run separately, and no documented single control stops all of them at once.

• Cursor help: Agent
• Cursor docs: Automations

Privacy Mode is documented as on by default only for teams and enterprise, and individuals are told to 'Toggle Privacy Mode on'. With it off, Cursor 'may use and store codebase data ... to train our models'. The Privacy Policy changes on publication, with continued use counted as acceptance, and legal disclosure has no notice commitment.

• Cursor help: Privacy and data
• Cursor Data Use
• Cursor Privacy Policy (sections 2, 3, 8)

API keys are visible and removable in Settings > Models, and Cursor says they are 'not persisted after the request completes'. There is no single documented view of every grant (GitHub/Slack apps, MCP OAuth tokens) with a per-grant revoke control.

• Cursor help: Bring your own API key
• Cursor docs: MCP

Deletion is self-serve from the dashboard, and 'All data is removed within 30 days'. It requires cancelling the subscription first, which makes it several steps, and no completion confirmation or coverage of backups and provider-side copies is documented.

• Cursor help: Delete your account
• Cursor Security (Account deletion)