Privacy

Your token stays local

Curse Monitor reads your Cursor session on this machine and never uploads credentials as a product feature.

CLI never uploads your token. Auth is resolved locally from Cursor state.vscdb, CURSOR_TOKEN, or --token. The access token is never logged or written to JSON output.

What we collect

Nothing from the CLI. No telemetry, analytics, or crash phones-home.
No credential vault files written by Curse Monitor.
Network calls go only to api2.cursor.sh (usage summary + Stripe profile) using your session Bearer token.
Optional local poll history (~/.config/curse-monitor/history.json or OS equivalent) stores Auto/API percentages only — never tokens.
Local insights (active models, daily Tab/Composer line stats, session titles) stay on disk inside Cursor’s own DB. We do not read chat bodies.

This marketing site

The static site at curse.lorapok.tech (or a *.pages.dev preview) may see standard web-server / CDN request logs (IP, user-agent, path). We do not run account login or store personal usage data on this site.

API stubs

The Worker under api/ is a placeholder. It returns usage: null and must not receive Cursor session tokens. Connecting to Mission Control at cursor-dev.lorapok.tech is future work — see docs.

Sibling products

Privacy practices for the full IDE extension live with that product — see cursor.lorapok.tech and lorapok.tech.

← Back home