TL;DR
Windsurf doesn't exist under that name anymore. Cognition renamed it Devin Desktop on June 2, 2026, and under Cognition's policy it trains on your code by default. Paid plans can opt out. Free plans can't. Cursor is the reverse: flip on Privacy Mode, which is available on the free plan, and Cursor doesn't train on your code and holds zero data retention agreements with its model providers. Both editors route your code to the same frontier model companies, so on a paid plan the gap is small. On a free plan it's the whole story.
If you picked Windsurf in 2024 because Codeium said it never trained on user code, that promise no longer covers you. The company that made it was acquired, its privacy policy URL now redirects to Cognition's, and the product you're running is called something else.
Our own earlier version of this page described the old setup too. This rewrite checks each claim against what the vendors publish today.
What changed since most comparisons were written
Three things, and the first two have nothing to do with features:
- Ownership and name. Cognition's own FAQ: "On June 2, 2026, Windsurf is becoming Devin Desktop." It's the same IDE, delivered as an over-the-air update.
windsurf.comnow returns a 308 redirect todevin.ai/desktop, andwindsurf.com/securityredirects to Cognition's security docs. - The training default. Codeium's old line was zero retention and no training. Cognition's security page now says: "By default, we may use your data for model training purposes to improve and enhance the Services."
- The models. The old pitch for Windsurf was one company end to end, with Codeium's own models doing the work. Devin Desktop's model list now includes Claude, GPT and Gemini alongside Cognition's own SWE models. That's the same multi-provider shape Cursor has always had.
We covered the policy redirect in detail in Windsurf (Codeium) Privacy Policy. The short version is that the document most people vetted is gone.
Side by side
| Cursor | Windsurf (Devin Desktop) | |
|---|---|---|
| Owner | Anysphere | Cognition |
| Trains on your code by default | Only if Privacy Mode is off | Yes |
| Can a free user turn training off | Yes, Privacy Mode works on free | No opt-out on the free plan |
| Who flips the switch on a team | Admin can enforce it; new members inherit it | Admin only on Teams |
| Retention at model providers | ZDR agreements with all providers when Privacy Mode is on | ZDR enabled with providers once you opt out |
| Model providers | Several (Cursor's data-use page names OpenAI, Anthropic, Meta and SpaceXAI) | Cognition's SWE models plus Claude, GPT and Gemini |
| Certifications | SOC 2 Type II, ISO 27001, ISO 42001, AIUC-1 | SOC 2 Type II |
| Ignore file | .cursorignore | .devinignore (legacy .windsurfignore and .codeiumignore still read) |
| Model runs on your own hardware | No, every request goes through Cursor's backend | Not documented |
Every row comes from the vendor's own page: cursor.com/security, cursor.com/data-use and docs.devin.ai/admin/security, all read on 2026-10-20.
Training and retention
Cursor
Privacy Mode is the switch that matters. Cursor's data-use page says that when it's on, "Customer Data will not be used for training by Cursor," and that Cursor "maintains zero data retention (ZDR) agreements with all providers." Its security page adds that Privacy Mode "is available to anyone (free or Pro)."
Two details people miss. First, with Privacy Mode off, Cursor says it "may use and store codebase data, prompts, editor actions, code snippets, and other code data" to train its models. So check the setting rather than assume it.
Second, bringing your own API key doesn't route around Cursor. In Cursor's words: "Even if you use your API key, your requests will still go through our backend! That's where we do our final prompt building."
Windsurf (Devin Desktop)
Cognition's rules depend on your plan:
- Free: training on by default, no opt-out.
- Paid individual: opt out on the Data Controls page. Opting out also turns on zero data retention with the model providers.
- Teams: same opt-out, but "only an administrator can exercise the opt-out."
- Enterprise: "we will never train on your data without your express prior written consent."
Most vibe-coded apps get started on the free plan, and that's the one plan with no switch to flip.
If you built on free Windsurf with real keys in the repo, assume those files were eligible for training under the default. Rotating a key takes five minutes. Trusting that a training pipeline discarded it takes faith.
Ignore files: the control that doesn't depend on a policy
Policies change hands. An ignore file keeps a file out of the AI's context no matter who owns the servers, so it's worth getting right in either editor.
Cursor reads .cursorignore using .gitignore syntax, and also skips anything in your .gitignore. Its default list already includes .env*. But Cursor's docs are honest about a gap: "The terminal and MCP server tools used by Agent cannot block access to code governed by .cursorignore." If the agent runs cat .env.production in the terminal, the ignore file doesn't stop it.
Devin Desktop reads .devinignore with the same syntax. By default it skips .gitignore paths, node_modules, and hidden paths (anything starting with a dot, which covers .env). Files matched by .devinignore "cannot be viewed, edited, or created by Devin." Your old .windsurfignore or .codeiumignore still works.
# Secrets and local config
.env*
*.pem
*.key
credentials.json
service-account*.json
# Customer data and dumps
*.sql
*.dump
exports/
Save it as .cursorignore, .devinignore, or both. It costs nothing to keep both in a repo that people open in different editors.
Which one to pick
On a free plan, Cursor. You can turn training off and you can't on free Windsurf. That one difference outweighs everything else in the table.
On a paid individual plan, it's close. Turn on Privacy Mode in Cursor, or opt out on Data Controls in Devin Desktop, and you get no training plus zero retention upstream from either. After that, pick on the editor you prefer.
On a team, make sure an admin has actually set it. Cursor lets an admin enforce Privacy Mode for everyone, and new members inherit it. On Windsurf Teams, individual developers can't opt themselves out at all.
If your code legally can't leave your network, neither one fits as shipped. Cursor sends every request through its own backend, and Cognition's documented deployments keep the model in its own cloud.
Neither editor makes the code it writes safe. The privacy settings above decide who sees your code. They do nothing about the hardcoded key, the missing auth check or the open database rule the AI just wrote. We find those in apps built with both editors, and they look the same either way.
A five-minute check for either editor
Is Windsurf still called Windsurf?
No. On June 2, 2026 Cognition renamed Windsurf to Devin Desktop and shipped it as an over-the-air update. It's the same editor with the same settings, and windsurf.com now redirects to devin.ai/desktop. The JetBrains plugin still carries the Windsurf name.
Does Windsurf train on my code?
By default, yes. Cognition's security docs say "By default, we may use your data for model training purposes." Paid plans can opt out on the Data Controls page, Teams plans need an admin to do it, and the free plan has no opt-out. Enterprise contracts say no training without written consent.
Does Cursor train on my code?
Not with Privacy Mode on. Cursor's data-use page says that with Privacy Mode enabled your data isn't used for training and Cursor holds zero data retention agreements with its model providers. With Privacy Mode off, Cursor says it may store and train on code data. Privacy Mode is available on the free plan as well as paid ones.
Is Cursor or Windsurf safer for a private codebase?
On a free plan, Cursor, because it lets you turn training off and Windsurf doesn't. On paid plans the two end up close: both can be set to no training with zero retention upstream, and both send your code to third-party model providers. Neither one stops the AI from writing insecure code.
Can I self-host Windsurf?
Cognition's current docs don't describe a self-hosted Devin Desktop. The deployment options they document for Devin keep the model, which they call the brain, in Cognition's cloud, with a dedicated single-tenant VPC as the most isolated tier. If a contract promises more than that, get it in writing.
Check what your AI editor actually shipped
CheckYourVibe scans apps built with Cursor, Windsurf and other AI tools for exposed keys, open databases and missing auth.