2026 Cursor SpaceX Privacy Mode: Privacy Checklist

A private repository is open in Cursor, but nobody can explain whether the request was used for training, retained, or routed through another server.

Fastest answer: check the current Privacy Mode and team policy first. As of August 19, 2026, Cursor says enabled Privacy Mode prevents Customer Data from being used for training, but it does not make Cursor a direct local client. A Cursor API key and a custom base URL still leave Cursor’s backend in the request path. If code must never reach Cursor infrastructure, use a tool that supports direct local inference instead. (Cursor Data Use & Privacy Overview)

This guide is for developers using personal Cursor accounts with private code, engineering leads reviewing workspace controls, and teams considering Ollama or another self-hosted model on a local or remote Mac.

Last updated August 19, 2026. Data checked against Cursor’s current Data Use & Privacy Overview, Cursor’s August 13, 2026 Terms of Service, Cursor security documentation, and the SpaceXAI Grok 4.6 release materials.

Three privacy goals with three different outcomes

The first mistake is treating “private” as one setting. A proper acceptance record separates three goals.

Preventing training

This is what Cursor’s Privacy Mode addresses. Cursor’s current data-use documentation says that, when Privacy Mode is enabled, Customer Data will not be used for training by Cursor. Cursor’s Terms of Service also state that Content is not used to train AI models unless the user explicitly agrees. (Cursor Terms of Service)

That is a training-control conclusion. It is not a claim that the code never leaves the workstation.

Limiting retention

Privacy Mode comes with a stronger retention position, but it still has an exception. Cursor says it maintains zero-data-retention agreements with providers and that providers will not store or train on data under Privacy Mode. It also says risk classifiers may temporarily retain prompts or conversations for abuse investigations if a request triggers a policy detector. (Cursor Data Use & Privacy Overview)

Therefore, the acceptance result should say:

• Training: not used for training under the stated Privacy Mode policy.
• Normal retention: designed around zero-data-retention and temporary processing.
• Exception: safety or abuse detection can create a separate retention path.

Keeping code away from Cursor infrastructure

Privacy Mode does not satisfy this requirement. Cursor’s documentation says that requests still pass through its backend even when a user supplies an API key. Cursor explains that its server performs final prompt construction before the request reaches the model provider.

A custom OpenAI-compatible endpoint does not automatically change that architecture. If the requirement is “the editor must call a local model directly,” the correct answer is to change the tool or integration, not to keep rotating API keys.

Evidence baseline after the SpaceX change

Cursor announced that its acquisition by SpaceX was complete on August 14, 2026. The announcement also identified Grok 4.6 as an early example of the combined direction. SpaceXAI published Grok 4.6 on August 12, 2026, and stated that the model was available in Cursor. (Cursor’s SpaceX announcement)

Those announcements confirm the corporate and product changes. They do not, by themselves, establish that private Cursor conversations are used to train Grok 4.6.

The relevant policy evidence is separate:

• Cursor’s Data Use & Privacy Overview says enabled Privacy Mode prevents Customer Data from being used for training.
• Cursor’s August 13 Terms say Content is not used for model training without explicit agreement.
• Cursor’s documentation still describes backend prompt construction.
• SpaceXAI’s Grok 4.6 documentation describes the model and API usage, but does not replace Cursor’s workspace privacy settings. (Grok 4.6 official documentation)

Some community articles and forum discussions claim that different Privacy Mode variants or older sessions may have been handled differently. Those claims are useful signals for what to test, but they are not proof of current policy. The current setting, current terms, and a recorded request test take priority.

Preparation: define the boundary before changing settings

Record the following before touching the configuration:

• Cursor application version and update date.
• Account type: personal, team, or enterprise.
• Workspace name.
• Team administrator or security contact.
• Current model, including whether it is Grok 4.6, another hosted model, or a custom model.
• Current Privacy Mode state.
• Whether codebase indexing is enabled.
• Whether Agent, background tasks, or subagents are allowed.
• Whether the requirement is no training, no retention, or no Cursor backend access.

This record matters because personal settings may not control a team account. Team-level policies can override the client setting, and the client may display an administrator-managed state instead of a freely changeable switch.

Codebase indexing is another separate path. Cursor says indexed code is uploaded in chunks to compute embeddings. It also says embeddings and metadata such as hashes and file names may remain in its database, while plaintext code used for embedding processing ceases to exist after the request. (Cursor Data Use & Privacy Overview)

Do not describe this as “nothing is uploaded.” That statement would be broader than the current documentation.

Settings review: Privacy Mode versus team control

Open Cursor Settings and search for Privacy Mode. The exact layout can change, so the acceptance record should capture the visible wording and date rather than rely on a screenshot copied from an older release.

Check these items in order:

• The switch is enabled.
• The control is not disabled, hidden, or marked as administrator-managed.
• The workspace shown in the account area is the intended one.
• The selected model is permitted by the workspace.
• Any notice about non-zero-retention models is understood.
• The team administrator confirms whether a policy forces or blocks the setting.

Cursor’s current data-use page distinguishes the two primary states:

• With Privacy Mode enabled, Cursor says Customer Data is not used for training and providers have zero-data-retention arrangements.
• With Privacy Mode disabled, Cursor says it may use and store codebase data, prompts, editor actions, code snippets, and other code data to improve AI features and train models. (Cursor Data Use & Privacy Overview)

Risk classifiers remain part of the boundary. Cursor says a prompt or conversation that triggers abuse detection may be stored for investigation and deleted under applicable retention policies. That exception should appear in an enterprise acceptance document.

Acceptance checklist: settings stage

• [ ] Open Cursor Settings and locate the current Privacy Mode control.
• [ ] Capture the visible state and any administrator-lock message.
• [ ] Record the review date as August 19, 2026, or the actual test date.
• [ ] Record the workspace name and account type.
• [ ] Record the selected model, including Grok 4.6 if applicable.
• [ ] Check whether codebase indexing is enabled.
• [ ] Ask the workspace administrator whether a team policy overrides the client.
• [ ] Save the official Data Use page and current Terms version with the review record.

API key review: credentials are not a privacy bypass

Cursor’s API key feature is easy to misunderstand. The setting can solve provider billing, account ownership, usage limits, or model availability. It does not prove that the Cursor application connects directly to the provider.

Cursor’s Data Use & Privacy Overview states that requests still go through Cursor’s backend with a user-supplied API key because Cursor performs final prompt building. Its security documentation gives the same architectural explanation.

The current API key documentation places provider keys under Cursor Settings > Models and describes a verification step. It also notes that custom API keys work with standard chat models, while some specialized features continue using Cursor’s built-in models. (Cursor API key documentation)

That creates two separate acceptance results:

• Training result: Privacy Mode controls whether Cursor says Customer Data can be used for training.
• Transmission result: the request still reaches Cursor infrastructure for prompt construction.

A useful test is to create a synthetic request with a unique marker such as ROUTE-CHECK-2026-08-19-A. Do not use source code, credentials, customer names, or proprietary identifiers. Record:

• The provider selected.
• The model name.
• The provider-side usage record, if available.
• The time of the request.
• Any request or trace identifier.
• Whether the request succeeded in chat only or also in Agent mode.

The provider billing record can prove that a provider received a request. It cannot prove that Cursor did not receive the prompt first.

Custom endpoint: Ollama is a routed workaround, not local direct access

Ollama can be useful for self-hosted inference, but the current Cursor architecture creates a hard boundary. A model listening on localhost or a private LAN address is not directly reachable by Cursor’s backend.

Current Cursor support guidance says that the Override OpenAI Base URL option needs a publicly accessible HTTPS endpoint because requests go through Cursor servers for final prompt construction. Community guidance describes tunnels and hosted reverse proxies as workarounds for Ollama, not as native local connectivity. (Cursor forum discussion about local LLM endpoints)

The configuration review should follow this sequence:

1. Open Cursor Settings > Models.
2. Review the provider API key section.
3. Confirm which key belongs to the intended provider.
4. Enable or inspect Override OpenAI Base URL.
5. Enter the authenticated HTTPS endpoint.
6. Add the exact custom model identifier.
7. Verify the key and endpoint.
8. Select the custom model in a new chat.
9. Test the endpoint with a synthetic probe.
10. Repeat the test in Agent or other task modes.

A typical self-hosted path looks like this:

Cursor backend -> authenticated HTTPS endpoint -> reverse proxy or tunnel -> Ollama

That is not equivalent to:

Cursor app -> localhost Ollama

The public endpoint introduces additional controls that must be reviewed:

• Authentication and key rotation.
• IP restrictions or identity-aware access.
• TLS certificate management.
• Request and response logging.
• Rate limiting.
• Replay protection.
• Tunnel exposure.
• Model name validation.
• Administrative access to the host.

A temporary tunnel may be acceptable for a disposable test. It should not be treated as a production security boundary without a documented review.

Request testing: prove the route instead of trusting the picker

The model picker is only configuration evidence. It does not prove that every Cursor capability uses the selected endpoint.

Use a clean test workspace containing no business code. Add a plain text file with a harmless marker, then send a request such as:

Return the marker exactly once and identify the configured model name.

At the custom endpoint, inspect:

• Request timestamp.
• Model field.
• HTTP response status.
• Authentication result.
• Response body marker.
• Request source or proxy log.
• Any generated request identifier.

Then compare the endpoint log with Cursor’s visible response.

Repeat the test for at least three paths:

• Standard chat or Ask mode.
• Agent mode.
• A background task, subtask, or other feature used by the team.

This distinction matters because Cursor documents different AI request paths for chat, Tab suggestions, background context building, and bug-finding workflows. The successful completion of one request does not prove that every feature uses the same route.

A successful chat request does not prove that Tab, Agent, or subagents use the same endpoint. If the model name does not match, the endpoint log is empty, or the feature silently falls back, mark the test as failed.

Save the following evidence:

• Cursor settings screenshot.
• Redacted endpoint configuration.
• Probe text and timestamp.
• Endpoint access log.
• Model response.
• Error message or request ID.
• Cursor version.
• Workspace and account type.

Never include API keys in screenshots. Redact authorization headers and tunnel URLs before sharing the record.

Failure handling: choose the boundary that actually matches the risk

Use the failure result to choose the next step.

Only training prevention is required

Keep Cursor if Privacy Mode is enabled and the workspace policy is recorded. If the switch is disabled or administrator-controlled, correct the team policy first. Do not claim that a personal setting overrides a workspace rule.

Controlled provider or self-hosted inference is required

Keep Cursor only if the organization accepts Cursor backend processing. Use a controlled HTTPS endpoint, strong authentication, limited logs, and a synthetic probe before exposing real repositories.

Code must never reach Cursor servers

Stop modifying API keys and base URLs. The current documentation explicitly says BYOK requests still pass through Cursor’s backend. Move to an editor or agent integration that supports direct local inference, or use a separate local workflow for the sensitive repository.

Continuous self-hosting is required

A local Mac may be unsuitable if it cannot remain online, lacks the required memory or storage, or cannot be isolated from ordinary user activity. A remote Mac can provide a more controlled runtime, but it still needs network policy, authentication, disk handling, and access logging.

For teams evaluating that option, ProxyMac can be used as the environment review point through its Mac environment console. The evaluation should begin with the model type, expected concurrency, uptime requirement, repository sensitivity, and whether Cursor is allowed to remain in the route.

Privacy Mode acceptance record

Use this compact record after the test:

• [ ] Training boundary: Privacy Mode is enabled, or the documented exception is approved.
• [ ] Retention boundary: risk-classifier and indexing exceptions are recorded.
• [ ] Backend boundary: the team explicitly accepts or rejects Cursor prompt construction.
• [ ] API key boundary: provider ownership and usage records were checked.
• [ ] Endpoint boundary: custom endpoint logs match the synthetic probe.
• [ ] Feature boundary: chat, Agent, and required subtask paths were tested separately.
• [ ] Model boundary: the visible model name matches the endpoint log.
• [ ] Evidence boundary: screenshots, timestamps, errors, and identifiers are stored without secrets.
• [ ] Fallback boundary: the team knows whether to keep Cursor, use a controlled endpoint, or switch tools.

If a continuous Ollama environment is needed, review the available Mac deployment options through the ProxyMac help center before committing sensitive code. The environment decision should follow the data boundary, not lead it.

FAQ

Training after the SpaceX acquisition

Cursor’s August 14 acquisition announcement and SpaceXAI’s Grok 4.6 release do not replace Cursor’s privacy controls. As of August 19, 2026, the current Cursor policy says enabled Privacy Mode prevents Customer Data from being used for training. The Terms also require explicit agreement for training use. Retention for abuse investigation remains a separate exception.

Finding the current Privacy Mode control

Open Cursor Settings and search for Privacy Mode. Record the exact wording shown in the current build, then check whether a team administrator controls the setting. An old screenshot is not sufficient evidence because the menu layout, policy labels, and model availability can change. Store the workspace name, review date, account type, and selected model with the screenshot.

Cursor API key routing

A Cursor API key does not create a direct connection between the editor and a model provider. Cursor’s own documentation says the request still reaches its backend for final prompt construction. The key changes the provider credential or usage path. It does not satisfy a policy that prohibits code from passing through Cursor infrastructure.

Ollama connectivity

Ollama on localhost or a private LAN address is not a direct Cursor endpoint under the current architecture. A public HTTPS service is needed for the routed workaround, often through a reverse proxy or tunnel. That introduces a new security surface. Authentication, access control, logging, and certificate management must be reviewed before using real repository content.

Endpoint verification

Use a synthetic probe and compare Cursor’s response with the endpoint’s access log. Confirm the timestamp, model identifier, status code, response marker, and request identifier. Test each required feature independently. If the endpoint receives no matching request, or the model name differs, the acceptance result is failed even if the model appears selected in Cursor.

Choosing the next environment

The current Cursor setup has three real drawbacks for sensitive work: code still reaches Cursor’s backend, API keys do not remove that routing layer, and Ollama requires an exposed HTTPS path rather than a true localhost connection. Privacy Mode can address the training question, but it cannot satisfy a strict “never pass through Cursor” requirement.

For temporary model testing, controlled self-hosting, or an isolated Mac environment, ProxyMac is the more practical route when local hardware is unavailable or must remain separate from daily development. The final choice should be based on the model, concurrency, uptime, and repository sensitivity. If the required boundary is fully local direct inference, the correct solution is a different editor or agent path rather than another Cursor setting change.

FAQ