Privacy

Version 1.2, effective 17 July 2026

Cursorly works out what is on your screen and points a cursor at the next thing to click. That only works if we're careful with what it sees. Here's exactly what happens, written to match how the product behaves rather than to bury it. You must be 13 or older to use Cursorly; if you're under 18, you need a parent or guardian's permission.

Who's behind it

Cursorly is an independent software project. Privacy and data questions go to privacy@cursorly.app, and we answer them ourselves. We do not sell or share your personal information, and never have.

This website

No cookies, no ads, no ad networks. The site uses Cloudflare Web Analytics, which is cookieless. It counts visits, pages, rough location, and where a click came from, without storing anything on your device or identifying you. The waitlist and feedback forms post directly to Supabase and set nothing on your device. If you email us, we keep that only to reply.

What the app sees when you use it

When you press the hotkey and type a goal, Cursorly:

• Takes in the window you're in as text and positions: the names of the buttons, menus, and fields on it. No picture of your screen is captured.
• So it can guide you anywhere on your PC, it also takes in the names of the things on your other open windows, the taskbar, and the Start menu.
• Sends a short text summary of that, plus your goal, to a language model so it can work out the next step.
• Moves a second cursor to the control you'd click next. It never clicks, types, or moves your real cursor for you.

Before anything is sent, a best-effort sensitive-context check looks at the window you're working in. If it matches a limited list (common password managers and well-known, mostly US, banking, login, and checkout sites), the snapshot is blocked and nothing leaves your machine for that session. It's a safeguard, not a guarantee: it doesn't recognise most banks, regional or desktop financial and health apps, or windows open behind the one you're using. Close sensitive windows before using Cursorly.

Screenshots

Cursorly does not take screenshots. No picture of your screen is captured while a task runs, so there is none to send to a model, none to store, and none left on your disk. A small number of unusual windows give it very little to work with, and for those a screenshot-based fallback exists in the program but is switched off in the version you can download. It cannot turn itself on quietly: you would be asked first, in a dialog, and your answer would be saved encrypted on your machine and reused until you changed it from the tray.

What goes to the model

In the default hosted mode, requests are routed through Cursorly's serverless proxy (a Supabase Edge Function), which forwards them with a server-held key to a hosted language-model provider (via OpenRouter, which routes to a downstream model provider). The request carries your goal and the text summary of the window, and no image of your screen. The proxy forwards the content and does not store it. If instead you set your own provider key, the app calls that provider directly and your data goes straight to them under their terms, not through us. If you run a local model, nothing leaves your machine at all.

What we keep on our servers

If you sign in, we keep two things. First, billing and usage records: your user ID, the model used, the cost, a call ID, and timestamps. Second, your task history: for each task you run, the goal text you typed plus metadata (the app it ran in, whether it succeeded, the step and replan counts, how long it took, the model, and token counts). The task history is what lets your History and Usage views follow you across the machines you sign in on. We still never store what was on your screen, window titles, or any image of it on our servers, only the goal text and that metadata. Sign-in is handled by Supabase (Google OAuth, PKCE); your email and tokens live there under their policy. When paid plans arrive, Stripe handles payments, and Cursorly never sees your card.

What's stored on your machine

A few small files under %LocalAppData%\Cursorly\, and nowhere else:

• session.json: your sign-in tokens, encrypted under your Windows account.
• ai.json: your own API key and model choice, if you set one, also encrypted.
• vision_consent.json: your answer to the screenshot question, if it was ever asked. Also encrypted.
• hotkey.txt: your chosen shortcut.
• plans.db: a small cache of recent plans (capped at 500 rows, 30 days) so repeat tasks feel instant.
• release-state.json: the app's startup safety-check (kill-switch) verdict.
• history.db: a local database of your past tasks, for the in-app History and Usage views.
• acceptance.json: a record of which Terms version you accepted, and when.
• logs\cursorly.log: the app's diagnostic log (plus one rotated copy, cursorly.log.1), for troubleshooting. It stays on your machine.

These files stay on your device; delete the folder and they're gone. Your task history is also kept on our servers (see What we keep on our servers above) so it syncs across the machines you sign in on; history.db is the local copy.

Children

Cursorly is not directed to children under 13, and we don't knowingly collect their personal data. If you believe a child under 13 has given us data, email privacy@cursorly.app and we'll delete it.

Crash reports

Crash reports are on by default. You can switch them off in Settings, under Crash reports, and once they're off Cursorly sends nothing when it crashes. A report carries the error, the point in our code it came from, the app version, and your Windows version. Before anything leaves your PC we strip the fields that carry your screen content, the goal you typed, window titles, and your tokens, and we send none of the local variables from the code that crashed.

Your data, your call

Ask us any time what's on file for you, and ask us to access, correct, or delete it: email privacy@cursorly.app from the address you signed up with. Deleting your account removes the data we control (your Supabase sign-in identity, your credit/usage rows, and your stored task history) and revokes active tokens, subject to minimal records we must keep by law. Your local files you delete yourself (remove the %LocalAppData%\Cursorly\ folder). We can't delete anything held by the AI provider, and in your-own-key mode we never held your data.

Changes

If this policy changes in a way that affects what's collected or who it's shared with, the version above changes and the old version stays in the public repo's history. Anything material gets surfaced in the app before it takes effect.

Back to the front page     Terms     Cookies