Summary
- When you verify, we collect your Discord account details, your IP address, a device signature and your browser state.
- We use them to detect alt accounts and ban evasion, and to restore you to a new server if the server you verified in is terminated.
- Server staff see the result of a check, such as "matches a banned account". They don't see your IP address or device signature.
- We don't sell your data, and we don't use it for advertising.
- You can revoke Cursor's access in Discord at any time, and ask us to delete your data.
1. Who we are
cursor.social ("Cursor", "we", "us") runs the Cursor Discord bot and the website at cursor.social. We are the controller of the personal data described in this policy. You can reach us at privacy@cursor.social.
This policy covers members who verify with Cursor, server owners and staff who use Cursor, and visitors to cursor.social. Cursor is not affiliated with Discord Inc. Discord's own handling of your data is covered by Discord's Privacy Policy.
2. What we collect
When you verify
Verification happens through Discord's official OAuth2 sign-in. We ask Discord for two permissions (called scopes):
identify: your Discord user ID, username, display name, avatar, banner and account creation date.guilds.join: permission to add you to a server. We use it only for restores (see Restores and OAuth2).
Discord gives us an access token and a refresh token so we can use these permissions. We don't request your email address, and we never see your Discord password.
Verification signals
During verification, our verification page and a second-party verification service collect:
| Signal | What it includes | Why we collect it |
|---|---|---|
| IP address | Your IP address and what can be worked out from it: approximate country and region, internet provider, network range, and whether it belongs to a VPN or looks unusual. | To flag VPNs, unusual IPs, and IPs near those of a blacklisted person. |
| Device signature | An identifier calculated from characteristics of your device and browser, such as operating system, browser version, screen size, graphics hardware, time zone and language settings. | To recognise the same device behind a different account. |
| Browser state | Browser settings and configuration, and small markers our verification page stores in your browser (see Cookies and local storage). | To recognise the same browser behind a different account. |
| Check results | Whether your signals match a banned or blacklisted account, and which signals matched. | To tell server staff whether to let you in. |
What we can't detect: we cannot detect proxies. We can detect VPNs, unusual IPs, and IPs near those of a blacklisted person.
From servers that use Cursor
- Server ID, name and the settings chosen for Cursor, such as the verified role and log channel.
- Bans and blacklist entries recorded through Cursor: the Discord user ID, the reason given, and the signals linked to that account.
- Moderation actions taken with Cursor: who took the action, who it affected, when, and the reason given.
- Membership events Cursor needs to work, such as when a member joins, verifies or is detained.
When you visit cursor.social
Our servers record standard request logs, including IP address, browser type, the page requested and the time, to keep the site running and secure. We don't use third-party advertising or analytics trackers.
When you contact us
If you email us or open a support ticket, we keep the messages and any details you choose to share so we can help you.
Account lookup
Account lookup. Anyone can look up a Discord account at cursor.social/lookup. It shows the account's username, display name and avatar, how many accounts Cursor has linked to it by device, browser and network, how many checks Cursor has run, and a trust rate. It also lists the handles of the linked accounts with the types of signal that matched. It never shows IP addresses, fingerprints or the servers those accounts were seen in. To have your profile removed, email privacy@cursor.social.
3. How we use it
- Detecting alt accounts and ban evasion: comparing your verification signals with accounts banned or blacklisted in the server you're joining.
- Verifying members: confirming you completed verification and giving you the server's verified role.
- Restoring members: adding you to a replacement server if the server you verified in is terminated.
- Moderation and anti-raid: detecting raids, keeping logs of actions and running staff commands.
- Keeping Cursor safe: preventing abuse of the bot and the website, and fixing problems.
- Legal reasons: meeting legal obligations and enforcing our Terms and Conditions.
We don't sell personal data, share it for advertising, or use it to build profiles for any purpose other than those listed above.
4. Legal bases
If you're in the European Economic Area, the United Kingdom or Switzerland, we rely on these legal bases:
- Legitimate interests: protecting communities from ban evasion, raids and abuse, and keeping Cursor secure. We limit what we collect and who can see it so these interests don't override your rights.
- Contract: providing the Service to server owners and members under our Terms, including restores you authorised.
- Consent: where the law requires it, for example for markers stored in your browser. You can withdraw consent at any time, though Cursor may then be unable to verify you.
- Legal obligation: where we must keep or share data by law.
5. Who can see it
- Server staff in a server you verify for see your Discord profile and the result of your check, such as "Detained, matches a banned account" and which types of signal matched. They don't see your IP address, location or device signature.
- Service providers that work for us under contract: hosting and database providers, and the second-party verification service that helps us analyse IP addresses and device signals. They may only use the data to provide their service to us.
- Discord, when Cursor uses Discord's API, for example to assign a role or add you to a server during a restore.
- Authorities, if the law requires it, or if it's necessary to protect someone's safety or defend our legal rights.
- A new owner, if Cursor is sold or merged. This policy would continue to apply to your data.
6. Restores and OAuth2
The guilds.join permission lets Cursor add your account to a Discord server. We use it only when:
- a server you verified in has been terminated or lost, and
- its owner starts a restore to a replacement server.
We never use it to add you to unrelated servers. To stop it, revoke Cursor in Discord under User Settings → Authorized Apps. We then can't include you in restores, and we delete your tokens.
7. How long we keep it
| Data | How long |
|---|---|
| Discord account details and verification signals | While you're verified in at least one server that uses Cursor. Deleted within 30 days after you revoke access or ask us to delete them. |
| Raw IP addresses | 90 days. After that we keep only the network range and VPN result needed for nearby-IP checks. |
| OAuth2 access and refresh tokens | Until you revoke access, ask for deletion, or the token can no longer be renewed. |
| Ban and blacklist records | As long as the ban or blacklist entry is active in that server. Deleted within 30 days after it's lifted or the server removes Cursor. |
| Moderation logs | Up to 12 months, or until the server removes Cursor, whichever comes first. |
| Website request logs | 30 days. |
| Support messages | Up to 12 months after your request is closed. |
| Backups | Deleted data can remain in encrypted backups for up to 30 days before it's overwritten. |
8. Security
We protect data with encryption in transit (HTTPS/TLS), encryption of OAuth2 tokens at rest, access limited to the people who need it to run Cursor, and regular review of our systems. No system is perfectly secure. If a breach affects your personal data, we'll notify you and the relevant authorities where the law requires.
9. International transfers
Cursor and its providers may process data in countries other than yours, including the United States. Where the law requires it, we protect these transfers with appropriate safeguards, such as the European Commission's Standard Contractual Clauses.
10. Your rights and choices
Depending on where you live, you may have the right to:
- access the personal data we hold about you and get a copy;
- correct data that's wrong;
- delete your data;
- object to or restrict how we use it;
- receive your data in a portable format;
- withdraw consent where we rely on it; and
- complain to your local data protection authority.
If you're in California, you also have the right to know what we collect and to request deletion, and we don't sell or share personal information as those terms are defined under California law. We won't treat you differently for using any of these rights.
How to use your rights
- Revoke access: in Discord, go to User Settings → Authorized Apps, find Cursor and select Deauthorize.
- Ask for a copy or deletion: email privacy@cursor.social or open a ticket in our support server. We'll confirm the request comes from your Discord account, then reply within 30 days.
If you ask us to delete your data while you're banned or blacklisted in a server that uses Cursor, we may keep a minimal record linking your signals to that ban for as long as the ban is active, so the deletion isn't used to get around it. We'll tell you if this applies.
11. Children
Cursor isn't meant for anyone under 13, or under the minimum age to use Discord in their country. We don't knowingly collect data from children below that age. If you believe a child has verified with Cursor, contact us and we'll delete their data.
12. Cookies and local storage
The cursor.social verification page uses a session cookie to complete sign-in, and stores small markers in your browser's storage as part of the browser-state check. These are strictly necessary for verification to work. We don't use advertising cookies or cross-site trackers. You can clear them in your browser at any time, but you may need to verify again.
13. Changes to this policy
We may update this policy as Cursor changes. We'll update the "Last updated" date above, and for significant changes we'll announce them in our support server before they take effect.
14. Contact
Questions or requests about your data? Email privacy@cursor.social or ask in our support server.