Yeah sounds like semantic indexing that cursor (pending acquisition by spacex/xAI) does.
https://cursor.com/docs/agent/tools/search
They upload your ssh keys too?
They might, if you use your home directory as the project directory, given that they only mention using gitignore as the blacklist.
More info: https://forum.cursor.com/t/codebase-indexing/36/18
So file contents are uploaded for embedding/indexing, but supposedly none of those contents are stored at Cursor after embedding.