Cursor's new code host launched with opt out enrollment and no published data retention policy

[SyntaxMage43]

A closer look at Cursor's newly launched Origin code hosting platform is surfacing a concern that got somewhat buried under all the excitement about its dramatic launch day timing against a major GitHub outage, that the service shipped with opt out rather than opt in enrollment for every paid Cursor plan except enterprise organizations whose administrators explicitly turn it off, and without any published data retention terms, subprocessor disclosures or training use policy covering code hosted natively on the new platform.

The underlying corporate context is worth spelling out plainly here, because it genuinely matters for evaluating the risk. SpaceX completed its sixty billion dollar acquisition of Cursor's parent company Anysphere just three days before Origin's launch, meaning that as of right now, all paid Cursor developers may be hosting real production code on infrastructure owned by SpaceX without any clearly published, formally documented policy governing what the company can or cannot do with that code once it lands there.

The rollout mechanics amplify the underlying concern rather than mitigating it in any real way. Because enrollment is opt out by default rather than opt in, a meaningful number of paid users likely became Origin customers without ever making a genuinely deliberate, informed choice to do so, simply by virtue of not proactively clicking away from a default setting they may not have even noticed existed. For individual developers and smaller teams without a dedicated legal or security review process in place, that default setting effectively becomes the actual decision made on their behalf.

Cursor's own public positioning frames this as a low risk multihoming strategy rather than a genuine migration commitment, emphasizing that GitHub remains the source of truth for anything that originated there and that Origin functions more as a convenience layer sitting alongside the existing setup. That framing genuinely does lower the immediate stakes somewhat for teams treating Origin purely as a synced mirror rather than their primary and only home for code, but it does not resolve the fundamental transparency gap around what actually happens to any code that gets created or edited natively within Origin itself.

Whether this becomes a real, sustained sticking point depends heavily on what Cursor actually publishes in the coming weeks, since companies frequently do eventually formalize policies that were genuinely still being worked out at a rushed launch moment. Until that documentation exists and is publicly available for scrutiny though, any team seriously evaluating Origin for anything beyond casual, low stakes experimentation is currently being asked to trust a fairly significant, largely undocumented gap on faith alone.

Cursor Origin Ships With No Data Terms: SpaceX Now Holds Paid Developers Codewww.techtimes.com