Privacy Policy
Cue is built local-first. Audio is never uploaded. Transcripts are encrypted on your device. Here's exactly what Cue does — and doesn't do — with your data.
Cue runs on your machine. Audio is transcribed on-device and never sent to a cloud transcription service. Transcripts are stored locally in an encrypted SQLite database. The data that leaves your machine is what you authorize when you connect an integration — AI queries to your chosen provider, including Calendar context for Calendar-based meetings, and read-only access to calendar and knowledge base sources — plus the usage analytics and error reports described below.
Effective September 4, 2026 · Version 1.2
Everything below is created and stored on your machine. Cue does not upload these stores. The specific cases where some of this content is transmitted — an AI query you send, an error report you file — are listed in the next section.
| Data | What it is | Where it's stored |
|---|---|---|
| Meeting audio | Microphone and system audio captured during a session | In memory only — never written to disk |
| Transcripts | Text generated from your meeting audio by on-device speech recognition — Apple SFSpeechRecognizer during the meeting, with a WhisperKit refinement pass on-device after it ends | SQLCipher-encrypted SQLite database in ~/Library/Application Support/cue-notetaker/ |
| Chat history | Questions you asked and AI responses during a meeting | Same encrypted database, scoped to each meeting |
| Meeting summaries | Structured summaries generated at your request | SQLite database; optionally exported to ~/Documents/ as Markdown if you enable auto-export in Settings |
| Knowledge Base | Indexed chunks from directories you connect | SQLite database (vector index) |
| Google Calendar | Upcoming event titles, dates and times, attendee names and email addresses, RSVP status, organizer, location, video-conference link, description, and recurring-event identifier; the connected Google account email | SQLite database for event data; settings file for the connected account email; macOS Keychain for the OAuth refresh token |
| Settings & API keys | Your preferences, connected account tokens, and API keys | Settings file and macOS Keychain (encrypted via safeStorage) |
The database is encrypted at rest with SQLCipher, using a 256-bit key Cue generates on first launch. That key is stored in a keyfile next to the database, readable only by your macOS user account (0o600 permissions, the same model SSH uses for private keys) rather than in the macOS Keychain. Because the keyfile and the database sit in the same directory, Cue asks Time Machine to exclude the keyfile from backups so that a backup does not carry both halves. API keys and OAuth tokens are encrypted separately, through the macOS Keychain.
Cue makes network requests only for the following purposes, and only when you have configured and authorized the relevant integration.
| Purpose | Where it goes | What's sent |
|---|---|---|
| AI answers | Your chosen LLM provider — FuelIX (default), Anthropic, OpenAI, Gemini, or local Ollama. On the FuelIX default, requests pass through a proxy operated by the Cue team before reaching FuelIX. A provider you configure with your own API key, and local Ollama, are contacted directly and do not pass through it. | Your question, relevant transcript context, and relevant Knowledge Base excerpts. For a meeting started from Google Calendar, Cue may also send the event title, schedule, attendee names or email addresses, recurring-event identifier, and description as meeting context. No audio is ever sent. For requests that pass through the Cue proxy, the proxy records your email address, the API path called, and a timestamp. |
| Google Calendar sync | Google Calendar API | OAuth authorization and read-only API requests. Cue reads upcoming event titles, dates and times, attendees, RSVP status, organizer, location, video-conference link, description, recurring-event identifier, and the connected account email. Cue does not create, edit, or delete Calendar events. |
| Atlassian knowledge | Your organization's Atlassian instance | Search queries when you have connected Atlassian as a knowledge source |
| GitHub knowledge | GitHub API | Read-only repository content queries when you have connected GitHub as a knowledge source |
| Auto-updates | Cue update service | A version check. No meeting content, transcripts, or account data are sent. As with any network request, the service observes your IP address. |
| In-app feedback | A report service operated by the Cue team, which files the report for the team to triage | The feedback text you write and voluntarily submit, plus app version and diagnostic context about the failure you are reporting |
| Sign-in and session | Google, then a session service operated by the Cue team | Your Google sign-in is verified once to confirm your email address and that your organization is permitted to use Cue. Your email address is then stored server-side against an opaque session token for up to 90 days, renewed while you keep using the app, so that you are not asked to sign in again. |
| Usage analytics | Google Analytics, exported onward to BigQuery for analysis | Product usage events — app opens, meeting starts, summaries generated, features used — with the app version and a pseudonymous identifier derived server-side. No meeting content, transcript text, or chat text is sent. |
| Error reports | Google Analytics and BigQuery, and a report service operated by the Cue team | The category and reason for a failure, the app version, and a stack trace. Stack traces name source files and functions inside Cue and can include file paths. No meeting content, transcript text, or chat text is sent. |
LLM providers receive meeting content. When you use an AI feature during a meeting, relevant transcript text is sent to your configured AI provider as part of the query. If the meeting was started from Google Calendar, the Calendar event context described above may be included. Review your AI provider's privacy policy to understand how it handles this data. Use Ollama (local) to keep AI processing on-device with zero network traffic.
By default, transcription uses Apple's on-device SFSpeechRecognizer — no audio leaves your machine. An opt-in cloud transcription mode is available in Settings for users who prioritize accuracy. If you enable it, audio is sent to Apple's cloud transcription service and is subject to Apple's privacy policy. This mode is explicitly labeled in Settings and off by default.
Cue separates your microphone from the meeting's incoming audio at the operating-system level and labels the two streams "You" and "Others". It does not analyze voices to tell speakers apart. Cue does not build voice profiles, voiceprints, or cross-meeting speaker identity records, and it does not retain audio from which any could be derived.
Cue's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Connecting Google Calendar is optional. Cue requests the https://www.googleapis.com/auth/calendar.readonly scope and the email scope. It reads your primary calendar to detect when a meeting is starting and offer to record it, title and organize meeting records, notice when a meeting has run past its scheduled end, show attendee context, and identify the connected account. Cue never creates, modifies, or deletes Calendar events, and it does not access other people's calendars.
Calendar data is used solely to provide those user-facing features. It is stored locally as described above. When you use Cue's AI features for a Calendar-based meeting, Cue may transfer the Calendar event title, schedule, attendee names or email addresses, recurring-event identifier, and description to your selected AI provider solely to provide that feature. Cue does not otherwise transfer Google Calendar data to third parties.
Cue does not sell Google user data, use it for advertising, or use it to develop, improve, or train generalized AI or machine-learning models. People do not read Google Calendar data unless you give affirmative consent, it is necessary for security or legal compliance, or it is otherwise permitted by the Google API Services User Data Policy.
Cue retains data for as long as you find it useful — there is no automatic expiry.
Open the Meeting Library and delete the meeting record. This cascades to its transcript, chat history, and summary in the database.
~/Library/Application Support/cue-notetaker/ — removes the database, its encryption keyfile (cue-notetaker.db.key), and settings.cue-notetaker entries — removes stored OAuth tokens and API keys.~/Documents/ manually.Deleting local data does not reach the two things Cue keeps server-side. Your session record — an email address against an opaque token — expires on its own within 90 days of your last use, and signing out of Google in Settings revokes it immediately. Usage analytics and error reports are pseudonymous and are retained for product analysis; because they carry no name or content, they cannot be traced back to an individual meeting. To have analytics associated with your installation excluded, contact the address below.
Go to Settings and disconnect the integration. Cue removes its locally stored credentials for that service and stops future syncing. You can also remove Cue's access from your connected service's account settings.
Cue records meeting audio on your device. You are responsible for informing all meeting participants that the meeting is being recorded. Recording laws vary by jurisdiction — some require the consent of all parties. Cue presents this requirement during onboarding and before each meeting. By using Cue to record a meeting, you represent that you have obtained any legally required consent from participants.
If we make material changes — particularly to what data is transmitted off-device or which third parties receive it — we will update the effective date above and notify active users via release notes or the in-app feedback channel.
Questions about this policy, or to report a security issue: michael.chapman@willowtreeapps.com