Privacy Policy

1. Introduction

Cursorhero ("Cursorhero", "we", "our", or "us"), operated by Cursorhero Labs, is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website (cursorhero.com) and use our AI cursor generation services.

By using the Service, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree, please do not access the Service.

2. Information We Collect

Personal Information

When you create an account or use our Service, we collect:

• Name and email address (provided during registration or via Google OAuth)
• Account credentials (handled by Better Auth; we never store plain-text passwords)
• Payment and transaction details needed to reconcile purchases. Historical Creem records remain; new one-time purchases use Waffo Pancake. We do not store full card numbers.
• Profile information (avatar URL from Google, display name)
• Cursor generation prompts, any reference image you attach to a generation, and the resulting cursor images you create
• Credit balance and transaction history
• Support communications (emails you send us)

Images You Convert in the Browser

This section and the reference-image items above were added on October 18, 2026 to accurately describe data already collected; they do not introduce new collection.

The PNG to cursor converter (/image-to-cursor) decodes, edits and encodes your image entirely in your browser. Images you convert there are not sent to us. If you then choose to generate a full AI cursor set from that image, a compressed copy is uploaded as a reference image and handled as described above.

Automatically Collected Information

When you visit our Service, we automatically collect:

• IP address and approximate geolocation (country-level)
• Browser type, device type, and operating system
• Pages visited, time spent, and click patterns
• Referral source (where you came from)
• Cookies and session tokens (for authentication)

Information from Third-Party Login

If you sign in with Google, we receive from Google:

• Your name, email address, and profile photo URL
• A verified email indicator (we trust the email is yours)
• No access to your Google account data, contacts, or files

3. Third-Party Services We Use

Cursorhero integrates the following third-party services to operate. Each service has its own privacy practices:

AI Image Generation

• Provider: Kie.ai (GPT Image 2.5 generation models)
• Data sent: Your cursor generation prompts, any reference image you attach (a compressed copy is kept in our cloud storage so the provider can fetch it), and the resulting AI-generated images
• Provider privacy policy: kie.ai/privacy-policy

Independent output screening is separate from the GPT Image 2.5 generation model. Sightengine submits original image bytes to an automated moderation workflow before publication, without customer email addresses or task identifiers. Output screening is enabled under explicit owner acceptance of known limitations, not full policy coverage certification. Copyright and character permissions, some deceptive impersonation or illegal-instruction semantics, and animated or fictional minors have not been comprehensively verified. Sightengine states that files are deleted after processing by default; storage features such as feedback, uploads and human-review workflows are not used by this adapter. These tests do not establish copyright permission or complete policy coverage. The legacy Kie.ai Gemini 2.5 Pro classifier remains a separate alternative with unverified chat retention and downstream training practices; there is no automatic fallback to it.

独立输出审核与 GPT Image 2.5 生图模型相互独立。Sightengine 接入会在发布前向自动审核工作流 发送原始图片字节，不发送客户邮箱或任务标识。输出筛查依据经营者明确接受已知局限的决定启用，并非完整策略覆盖认证。 版权与角色授权、部分欺骗性冒充或违法指令语义，以及动画或虚构未成年人的识别尚未得到全面验证。Sightengine 声明默认在处理后删除文件；此适配器不使用反馈、上传存储或人工复核工作流。 这些测试不证明版权授权或完整策略覆盖。原 Kie.ai Gemini 2.5 Pro 分类器作为独立备选保留， 聊天接口留存及下游训练实践仍未核实，不会自动回退到该服务。

Payment Processing

• Historical provider: Creem (creem.io) for earlier orders and billing records.
• Current provider: Waffo Pancake processes new one-time purchases. Historical Creem orders and purchased rights remain supported; there is no Creem fallback for new purchases.
• Data: When a provider processes a purchase, it receives the billing and transaction details needed for that transaction. We do not store full payment card details on our servers.

Transactional Email

• Provider: Resend (resend.com)
• Data sent: Your email address (for verification, password reset, receipts)

Database and Hosting

• Database: PostgreSQL hosted on Neon (neon.tech)
• Application hosting: Vercel (vercel.com)
• Generated cursor file storage: Cloudflare R2 (cloudflare.com)

Site Analytics

• Providers: Google Analytics, Microsoft Clarity and PVUV
• Data: Aggregated page views, referral source, approximate country, device and browser type, and Clarity session replays or heatmaps (with form inputs masked). PVUV stores a first-party cookie (_pv_id, up to 396 days) so repeat visits can be counted.
• Your choice: In the EEA, the UK, Switzerland and China, analytics load only after you allow them. Elsewhere they load by default and you can turn them off under “Analytics settings” in the footer; turning them off deletes the analytics cookies and stops future loading in that browser.
• PVUV privacy policy: pvuv.ai/privacy

Authentication

• Provider: Better Auth (open-source library; sessions stored in our database)
• OAuth provider: Google (sign-in only, no data sharing beyond basic profile)

4. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the AI cursor generation Service
• Process one-time cursor pack purchases and maintain account purchase records
• Send you transactional emails (verification, receipts, account notifications)
• Respond to your support requests
• Detect and prevent abuse or fraudulent use of our Service
• Improve the Service (aggregate, de-identified analytics only)
• Comply with legal obligations

We do NOT:

• Sell your personal information to third parties
• Use your prompts or generated cursors to train our own AI models. We do not claim that downstream providers never retain data or use it for training; the chat-screening endpoint’s practices remain unverified.
• Send you marketing emails without your explicit opt-in

5. Data Storage and Security

We implement industry-standard security measures to protect your information:

• HTTPS/TLS encryption for all data in transit
• Encrypted password storage (bcrypt hashing via Better Auth)
• Database access restricted via short-lived credentials and IP allowlists
• Regular dependency updates and security patches
• Row-level data isolation by user ID in all queries

However, no method of transmission or storage is 100% secure. We strive to protect your data but cannot guarantee absolute security.

6. Data Retention

We retain information as needed to provide and secure the Service, maintain account and purchase records, and meet applicable legal obligations. Retention periods vary by record type and applicable requirements; we do not state a fixed deletion timeline here.

• Account and generation data: Used to operate account features and generation history.
• Reference images: Stored in our cloud storage at an unguessable address so the AI provider can fetch them. They are not deleted automatically; contact us and we will delete them on request.
• Payment records: Kept for purchase reconciliation and applicable accounting or legal needs.
• Support and email data: Used to handle the related communication and service request.

To ask about access, correction, or deletion of account data, contact us using the details below. Some purchase or security records may need to be retained where required.

7. Your Rights

You have the right to:

• Access: Request a copy of all personal data we hold about you
• Rectification: Correct inaccurate personal data
• Deletion: Delete your account and associated data (Settings → Delete Account)
• Export: Download your generated cursor packs and account data
• Opt-out: Unsubscribe from any optional marketing emails

To exercise any of these rights, visit your account Settings page or email us at the contact below.

8. International Data Transfers

Your data may be transferred to and processed in the United States, Singapore, or other countries where our service providers operate. By using the Service, you consent to such transfers.

Available transfer safeguards depend on the applicable provider and arrangement. We do not make a general certification claim here; contact us with questions about a specific data transfer.

9. GDPR Rights (EEA / UK Users)

If you are located in the European Economic Area or United Kingdom, you have additional rights under the General Data Protection Regulation (GDPR), including:

• Right to be informed about data processing
• Right to erasure ("right to be forgotten")
• Right to data portability in a machine-readable format
• Right to object to processing
• Right to lodge a complaint with a supervisory authority

10. Children's Privacy

Our Service is not intended for children under 18 years of age (or the age of digital consent in your jurisdiction, whichever is higher). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us immediately so we can delete it.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email and by posting a notice on the Service at least 14 days before changes take effect. The "Effective Date" at the top will be updated.

12. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at:

• Email: [email protected]
• Privacy inquiries: [email protected]
• Website: https://cursorhero.com