cursor icon indicating copy to clipboard operation
cursor copied to clipboard

About code privacy

Open hongbo-miao opened this issue 2 years ago β€’ 8 comments
trafficstars

The tool is amazing! I am wondering what data does it collect? Thanks! πŸ˜ƒ

hongbo-miao avatar Mar 17 '23 04:03 hongbo-miao

Hey! Everytime you invoke the AI, we store some of the code from the current file in a hosted analytics service called HumanLoop. This lets us improve our prompts. We also store your prompts in Posthog, an open source analytics tool. We don't use any of this data to train models.

We're thinking of adding an option where absolutely no code is stored anywhere. Lmk if that'd be helpful! Want to see where people prefer to be on the spectrum of product improvement and not-storing-anything.

truell20 avatar Mar 17 '23 04:03 truell20

@truell20 I understand this is needed to help improve the product but storing readable code in an analytics tool is a huge privacy issue for a lot of developers and might limit your growth potential. Storing prompts is still not great but better than storing code. Hopefully you guys will find a better way to analyze and improve the product without it.

Can you tell us for how long the code is stored, who has access etc...?

usergit avatar Mar 17 '23 04:03 usergit

@truell20 adding that option would be very helpful! The more transparent, the better. ☺️

hongbo-miao avatar Mar 17 '23 07:03 hongbo-miao

There should be an ignore file to prevent reading sensitive information, such as config file.

rangoack avatar Mar 17 '23 12:03 rangoack

This is super helpful feedback! Will add into the editor.

truell20 avatar Mar 17 '23 20:03 truell20

We're thinking of adding an option where absolutely no code is stored anywhere. Lmk if that'd be helpful! Want to see where people prefer to be on the spectrum of product improvement and not-storing-anything.

The absolutely no code stored option would be a must if the tool is going to be used on IP restricted projects.

However, some orgs might be willing to allow the AI to consume their entire code base (sans secrets of course) when interacting with it if there are legally binding guarantees of IP ownership and non-disclosure from Cursor. This is because developers should understand that the more that an AI knows about the problem being worked on and the context around it, the more helpful it could potentially be.

MatthewAry avatar Mar 24 '23 18:03 MatthewAry

Might be a bit of a technical implementation, but could the code be minified on the input side to prevent leakage of specific names, while still learning from the overall structure? I'm wondering if that would allow for a trade-off between the two, cause it's not like you can just run a PII cleaner over a code-base.

Also couldn't find a privacy policy anywhere...

djpecot avatar Apr 06 '23 19:04 djpecot

we store some of the code from the current file in a hosted analytics service called HumanLoop

Is that also the case if you enter your own API key and pay for the model usage yourself? What about a paid option on cursor's side @truell20?

Would absolutely love to use cursor, but it gets nowhere near confidential code under current conditions, as regrettable as it it.

otto-dev avatar Apr 17 '23 04:04 otto-dev

Might be a bit of a technical implementation, but could the code be minified on the input side to prevent leakage of specific names, while still learning from the overall structure? I'm wondering if that would allow for a trade-off between the two, cause it's not like you can just run a PII cleaner over a code-base.

This is a really interesting idea.

Also couldn't find a privacy policy anywhere...

This is now up on the site! https://www.cursor.so/privacy

truell20 avatar Apr 30 '23 23:04 truell20

The absolutely no code stored option would be a must if the tool is going to be used on IP restricted projects.

This is now up. Just click on the settings gear in the top right, then Advanced, then Local/Ghost mode.

truell20 avatar Apr 30 '23 23:04 truell20

Is that also the case if you enter your own API key and pay for the model usage yourself? What about a paid option on cursor's side @truell20?

Would absolutely love to use cursor, but it gets nowhere near confidential code under current conditions, as regrettable as it it.

Anyone can turn on the no-storage mode πŸ™‚ No need to pay. No need to use your own API key (unless you want to ofc!)

truell20 avatar Apr 30 '23 23:04 truell20

Is it possible to specify that cursor ignore config files that may contain API secrets?

roark avatar Sep 18 '23 18:09 roark

I might be blind, but I cannot see the advanced button in the settings, was it removed ? (I am using chrome)

Screenshot 2023-10-02 at 12 23 12

MatthieuToulemont avatar Oct 02 '23 10:10 MatthieuToulemont

It is also not visible on safari ( cc @truell20 )

MatthieuToulemont avatar Oct 02 '23 10:10 MatthieuToulemont

@MatthieuToulemont You can find the local mode in the app under settings. image

jakobFNF avatar Oct 19 '23 20:10 jakobFNF