They might, if you use your home directory as the project directory, given that they only mention using gitignore as the blacklist.
So file contents are uploaded for embedding/indexing, but supposedly none of those contents are stored at Cursor after embedding.