2.1 Information you provide directly

Email address — supplied at checkout to receive your CDK, refund confirmations, and security notices.
CDK — the licence key we issue you. A CDK is not personal data on its own, but it functions as an identifier that we associate with your email address.
Support correspondence — the content of any email, chat, or form message you send us.

2.2 Information collected automatically by the desktop app

When you activate or refresh a licence, the desktop application transmits the following to our activation endpoint:

Hashed machine identifier — sha256(IOPlatformUUID). The hash cannot be reversed to the original identifier; it is used to distinguish devices for the two-device concurrency limit.
Machine name — the human-readable name that appears in the in-app fleet view, chosen by you.
Application version — for compatibility enforcement and security patch tracking.
Anonymous crash counts — an integer counter for unhandled exceptions since the last successful launch, with no stack traces, no file paths, no prompts, and no identifiers.

We do not log your IP address to the database. Incoming request IPs are used only in ephemeral rate-limit and abuse-detection layers and are not persisted alongside your record. We do not embed Google Analytics, Meta Pixel, TikTok Pixel, or any other third-party tracker on the website or in the desktop application.

2.3 Information collected by Waffo Pancake at checkout

Payment information — including cardholder name, card number, expiry, CVV, billing address, and tax identifiers — is collected and processed by Waffo Pancake, our Merchant of Record, under its own privacy policy. Waffo Pancake is PCI-DSS certified. We do not receive or store card data. What we do receive from Waffo is a transaction identifier, the country of billing, the currency of the transaction, and the email address you provided at checkout.

2.4 What stays on your device

The prompts you send, the source code you route through the cursor-proxy sidecar, and the responses returned by upstream AI providers do not touch our servers. The gateway runs on your Mac and connects directly from your machine to the upstream backend you configure (by default the Cursor cloud). We have no visibility into that traffic.