Privacy policy

Effective date: October 22, 2026

This policy explains what personal information Cursor Style ("we", "us") collects, how we use, store, share and protect it, and the choices you have. It applies to:

Cursor Style Chat: the chat, profiles, friends, calls, albums and games at cursor.style and chat.cursor.style, and our Android app (package style.cursor.chat) where it is available;
the cursor.style website: cursor collections, accounts, feedback and downloads; and
the Cursor Style extension for Google Chrome.

The Cursor Style extension for Microsoft Edge has its own privacy policy. If you have questions, write to [email protected].

Summary

Signing in with Google gives us only your basic Google profile: name, email address, profile picture, language and Google account ID. We never access your Gmail, Google Drive, Contacts, Calendar or any other Google service.
We do not sell your personal information, and we do not use Google user data for advertising.
Your public display name, username, avatar and posts are visible to other people, as described below. Direct messages are not end-to-end encrypted.
You can delete your account at any time at cursor.style/account/delete, and you can revoke Google access at any time in your Google Account.

Information we collect

Account and profile. Display name, username, email address (when you provide one or sign in with Google), internal user ID, avatar, language, country-visibility and other privacy preferences, and optional profile details you choose to add. Guest accounts also have a user ID, a username, activity and chat data, so they are not data-free.
Year of birth. We ask for your year of birth, not a full date. We keep it with your profile and do not verify it.
Content you create. Messages in rooms, groups and direct messages; replies, reactions, poll votes; photos, avatars, albums, GIF references, voice clips, music files and other media with their descriptions; posts and comments; friend requests, blocks and reports. Rooms, posts and profiles can be seen by other people, depending on the feature and your settings, so do not put private information in them.
Calls. Audio and video calls are set up between users' devices (WebRTC) and the media is encrypted in transit. When a direct connection is impossible, the media is relayed by TURN servers run by us and by Cloudflare, which can see the IP addresses involved but not the content. We do not record calls. We keep short-lived call history (participants, time and duration).
Optional linked profiles. If you link a game profile such as Roblox, we receive the basic profile information that service shares with us (for Roblox, the openid and profile scopes).
Technical data. IP address, approximate country derived from the IP address or Cloudflare country header (not precise location), browser or device type, session and authentication identifiers, last-activity time, and operational and security logs.
Notifications. If you allow push notifications in the mobile app, we store a Firebase Cloud Messaging registration token, installation ID, platform, app version, language and notification preferences. Push messages are generic by default ("New message") and do not include the sender's name or message text.
Cookies and local storage. Our sites use cookies and browser storage for sign-in sessions, language, theme, chat settings, and linking the browser extension to your account. The website also uses analytics and advertising cookies, described in "Analytics, advertising and the website" below.
Cursor Style Chrome extension. The extension keeps your cursor choices in your browser's extension storage. It creates a random installation ID (UUID) and sends anonymous event names (such as install, uninstall and daily-active) tagged with that ID to Google Analytics. It does not collect your browsing history, page content, passwords or form data. If you sign in on the website, the installation ID can be linked to your account so your collection syncs.

Google user data

This section describes how we handle data we receive from Google APIs. It is part of this privacy policy for the purposes of the Google API Services User Data Policy.

Sign in with Google (all users)

Scopes requested: openid, email and profile only. These are Google's basic sign-in scopes. We request online access, so we receive no refresh token and cannot reach your Google account after you sign in. We do not store Google access tokens.
Data we receive: your Google account ID, name (full, given and family), email address, profile picture URL and language/locale.
How we use it: to create your account or sign you in; to match Google sign-in to an existing account that uses the same email address; to prefill your profile (your Google name becomes your initial display name; your initial username is generated from the part of your email address before the "@"; your Google profile picture may be shown as your avatar until you pick another); to send account messages such as account-deletion confirmations; to prevent abuse; and to provide support. You can change your display name and username in your profile settings, subject to rate limits.
What other people can see: your display name, username and avatar. Your email address, Google account ID, and given and family names are not shown to other users.
How we store it: in our account database on our hosted infrastructure, protected by access controls and encrypted connections. We keep it for as long as your account exists, and delete or de-identify it when you delete your account (see "Retention and deletion").
Who we share it with: nobody except the service providers listed below that we need to run the service, or authorities when the law requires it. We do not sell it or share it with data brokers or advertisers.

Google Analytics data (one authorized administrator only)

This is not offered to visitors or users. An authorized administrator of cursor.style can connect their own Google account so our server can read, with read-only access, the aggregate install and uninstall event counts that the Chrome Web Store reports for our extension listing to our own Google Analytics 4 property.

Scope requested: https://www.googleapis.com/auth/analytics.readonly (together with openid and email to identify the connecting account).
Data accessed: daily aggregate event counts (event name, date, count and total users) for that one Analytics property. It contains no personal information about our users.
How we use and store it: the counts are saved in our database and shown on an internal admin dashboard so we can measure the growth of our extension. We store the administrator's Google email address and an encrypted refresh token so the daily sync can run.
Revocation: the administrator can revoke access at any time at myaccount.google.com/permissions. When access is revoked or no longer needed, we delete the stored token.

Limited Use

Our use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. In particular:

We use Google user data only to provide and improve the user-facing features described in this policy.
We do not transfer Google user data to others except to provide or improve those features, to comply with applicable law, for security or abuse investigations, or as part of a merger, acquisition or sale of assets with notice to users.
We do not use Google user data for serving advertisements, including retargeting, personalized or interest-based advertising.
We do not allow humans to read Google user data unless we have your consent, it is necessary for security purposes such as investigating abuse, to comply with the law, or the data is aggregated and used for internal operations. Our staff see account details such as an email address only when this is needed to provide support, investigate abuse or security issues, or comply with law.
We do not use Google user data to develop, improve or train generalized artificial intelligence or machine-learning models.

How we use information

To provide, maintain and secure the service: accounts, sign-in, chat, profiles, calls, uploads, friends, notifications and games.
To keep the community safe: automated and human review of messages, images and voice clips, handling reports, enforcing our rules and terms, banning abusive accounts, and preventing spam, fraud and other abuse.
To translate messages when you ask us to, and to show country rooms and the privacy settings you choose.
To understand how the service is used and to fix problems, measure performance and plan improvements.
To communicate with you about your account, support requests and important changes.
To meet legal obligations and protect the rights, safety and property of our users and ourselves.

Where the law requires a legal basis, we rely on performing our contract with you (providing the service), our legitimate interests (safety, security and improving the service), your consent (for example, push notifications and optional features) and legal obligations.

Who else can see or receive information

Other users. Your display name, username, avatar and the content you share in rooms and posts are visible to others as the feature and your settings allow. Direct messages go to the people in the conversation and, as noted above, are processed on our servers and are not end-to-end encrypted. Your country can be shown on your profile according to your privacy settings.
Service providers that process data for us, only as needed to run the service:
- Cloudflare: content delivery, DNS and security filtering, object storage for uploaded media, TURN relays for calls, and automated image and voice safety checks on uploads.
- Oracle Cloud Infrastructure and Amazon Web Services: servers, managed databases, secret storage and email delivery.
- OpenAI and Google (Gemini): automated moderation and translation of message text, usernames and images, and the AI-powered assistant accounts that take part in chat. Messages in conversations those accounts take part in are processed by these providers.
- Giphy: GIF search. Your search terms are sent to Giphy, and your browser may load GIFs directly from Giphy, which reveals your IP address.
- Deezer and Apple (iTunes Search): when you share an audio file, its title may be sent to find the artist and cover art.
- Google: sign-in (above), Analytics, AdSense, Fonts, browser-side translation (which can send selected message text to Google Translate) and Firebase Cloud Messaging for push notifications.
Moderators and staff. Authorized staff can review content, reports and account details to enforce our rules and help users.
Legal and safety. We may disclose information when we believe it is required by law or legal process, or necessary to protect the safety of children and others, including reporting illegal content to the appropriate authorities.
Business changes. If we are involved in a merger, acquisition or sale of assets, information may be transferred and we will tell you if your information becomes subject to a different privacy policy.

We do not sell your personal information. We and our providers may process and store information in the United States and in other countries where those providers operate.

Analytics, advertising and the website

The cursor.style website and chat use Google Analytics to measure traffic and usage, and some website pages (for example collections and feedback pages) display Google AdSense advertisements. Google may set cookies and process your IP address and browsing activity on these pages. You can control personalised ads at adssettings.google.com, and you can block cookies in your browser. Our cookie policy has more detail. We do not use Google user data received through Sign in with Google for advertising.

Retention and deletion

Account data and content are kept while your account exists.
Deleting your account. Go to cursor.style/account/delete, enter your account email, and open the confirmation link we email you (it is valid for 24 hours). We then delete your account, your sign-in identity (including the Google data described above) and your authored chat records where possible. Some content, such as messages you posted in public rooms, may remain visible with your display name removed, and limited records needed for safety, abuse prevention, legal compliance or dispute resolution may be kept. Deleted data can remain in encrypted backups until those backups rotate out. If you cannot access the account email, contact [email protected] and we will help after verifying your identity.
Temporary data. Caches, such as translation caches, expire automatically (for example, up to 90 days after last use), and operational logs are kept only for a limited time. Call history is short-lived, and calls are not recorded.
Google Analytics connection. The administrator's refresh token is kept until access is revoked or no longer needed, then deleted.

Your choices and rights

Edit your profile, avatar, display name and privacy settings (profile visibility, country display, "joined" notices, mention and statistics privacy) in your account settings.
Block or report other users, and turn notifications on or off.
Sign out, or revoke Cursor Style's access to your Google account at myaccount.google.com/permissions.
Delete your account (see above).
Depending on where you live, you may have the right to access, correct, delete, export or restrict the use of your personal information, to object to certain processing, and to withdraw consent. Write to [email protected] and we will respond within the time required by law. You may also complain to your local data protection authority.

Security

We protect information with encrypted connections (HTTPS/TLS) for the website and chat, access controls, password hashing, and encrypted storage of sensitive credentials such as the administrator's refresh token. No online service is perfectly secure, so please use a strong password and keep your devices safe. Tell us right away at [email protected] if you believe your account has been compromised.

Children

We do not verify the age of the people who use Cursor Style Chat. Our child safety standards explain how we protect younger users. If you are a parent or guardian and want a child's account and data reviewed or deleted, contact [email protected] and we will review the request and delete the account and data where appropriate.

Changes to this policy

We may update this policy as the service or the law changes. We will post the new version here with a new effective date, and, if the changes are material, we will give additional notice in the service.

Contact

Cursor Style · [email protected] · cursor.style

See also our terms of service, cookie policy, child safety standards and account deletion instructions.

Safer for kids