What CueCue keeps, and where.

What stays on your Mac

• Your listening journal. When a track in Spotify or Apple Music has played long enough to count, CueCue writes it to a journal file on your Mac.
• Your monthly chart. Once a month, your Mac turns the month's journal into a chart and publishes it, unless you turn that off in the Crate's Charts. Your journal itself stays on your Mac.
• Your cues. Each recording, with its transcript, the track it answers, and any video, becomes one cue file in CueCue's folder on your Mac. Every cue starts private.
• Transcription. Your voice is transcribed on your Mac, by a model stored on your Mac. The audio isn't sent anywhere to be transcribed.
• Raw recordings. The temporary recording files are deleted once a cue is saved or discarded. Any a crash leaves behind are deleted after a day, the next time CueCue starts.
• Microphone and camera. Used only while you're recording. The camera is used only when you choose a video cue.
• A log file at ~/Library/Logs/CueCue/cuecue.log, for troubleshooting. It never records what you said, it shortens paths inside your home folder to ~, and it blanks out the key that links your Mac to your account.
• The floor. Before a cue goes public or is shared with an artist, your Mac checks it against CueCue's published rules: phone numbers or email addresses spoken in it, sustained loudness, and, for video, rapid flashing or long stretches of black or frozen picture. The check runs on your Mac and sends nothing anywhere. A published or shared cue records that it passed and which version of the rules it passed. A cue that doesn't pass stays private. The checks can't catch everything; for example, numbers spoken as words aren't recognized.

None of this leaves your Mac unless you publish a cue, share one with an artist, your monthly chart publishes, or you send feedback, as described below.

When CueCue talks to the internet

The app makes network requests in exactly these cases:

• Hugging Face, once: CueCue downloads its transcription model (about 148 MB) the first time it opens. It downloads it again only if the file on your Mac fails its integrity check.
• MusicBrainz and the Cover Art Archive, when your music player doesn't supply cover art: CueCue searches MusicBrainz with the track's artist and album, then fetches the cover from the Cover Art Archive.
• CueCue's website, when you pair. The app sends the eight-character pairing code and your Mac's name (its network name, which you can rename on your account page).
• CueCue's website, when you publish. The app uploads the cue: its details (track title and artist, your transcript, and file checksums), the cue file, its audio, and the video only if you include it.
• CueCue's website, when you share with an artist. The app uploads the same files as publishing, described below under “Sharing with an artist”.
• CueCue's website, once a month. Unless you turn monthly charts off, the app uploads each finished month's chart, described below.
• CueCue's website, once a day, to check for a new version. The request carries CueCue's version and nothing about you or your music, and the website doesn't record it. If there's an update, CueCue shows what's new and downloads it only when you press Install Update, or, if you tick the box in that window, automatically from then on.

There is no analytics, advertising, or crash-reporting service in the app, and its windows load nothing from other sites, fonts included.

To pause and resume your music while you record, and to read the current track when macOS won't say, CueCue sends Apple Events to Spotify or Music on your Mac. That stays on your Mac.

Send feedback… in the menu-bar menu opens a new email in your own mail app with the app version, your macOS version and the last 200 lines of the log filled in. Nothing is sent until you press Send, and you can edit it first.

What the website stores

The website runs on Cloudflare Pages. It keeps:

• Tester sign-ups: the email address, role (listener, artist or both), platform and time you signed up, in a key-value store.
• Your account: your handle, display name and description, your public Crate style, and your passkey's public key. The private half of a passkey never leaves your device.
• A recovery email, only if you add one on your account page. Email delivery isn't switched on yet, so CueCue sends nothing to it.
• Earlier handles: if you change your handle, the old one stays reserved to your account.
• Devices and sign-ins: each paired Mac's name, when it was last seen, and whether you've revoked it; plus your active sign-in sessions.
• Published cues: the uploaded cue files, and a record of each cue's publishing state.
• Monthly charts: each published month's chart: counts by day, your top artists and tracks, and the moments on your Charts page. If you make Dig public, it also stores each listen's artist, track, day and hour, never the minute.
• Your IP address: to limit abuse, the site counts requests per IP address, per minute, for sign-up, joining, passkeys, pairing, recovery and uploads. Wrong pairing codes are counted per IP address for 15 minutes.

What “public” means

A published cue can be read, played and downloaded by anyone with the link, and it appears on your public Crate page. That includes the cue file and its audio, and the video only when you included it and approved it for public viewing.

Video cues. When you publish a video cue audio only, the video is removed from the published cue file. Only video you approve in the Booth is published.

Charts. Your Charts page shows your published months to anyone. Charts publish automatically each month; you can turn that off, or remove a month, from the Crate.

The listen behind a cue. A cue made from a listen carries that listen's record from your journal: when the track played, and whether Spotify or Apple Music played it. Publishing the cue publishes that record with it.

Sharing with an artist

Sharing a cue with an artist uploads a private copy of it to CueCue, kept apart from your public Crate. Only the artist the cue names can open it, after they show CueCue they're that artist; until then the link shows the track's title and artist and nothing else. The artist can play, read and download the cue and sees your handle. Revoking the share deletes the copy straight away. An artist who has verified also sees, on their own page, the cues about their music that listeners have made public.

How long things are kept

• A browser sign-in lasts an hour; a paired Mac stays signed in for 30 days. Pairing codes and passkey challenges expire after five minutes.
• The per-IP counters expire when their minute is up (15 minutes for wrong pairing codes). Expired counters, sessions and codes are deleted the next time someone uses that part of the site. There's no scheduled clean-up, so an expired row can wait until then.
• Unpublishing a cue deletes its files from storage straight away. The record that it was once published stays.
• Removing a month from your Charts page deletes its chart from storage straight away.
• Your sign-up, account, devices and earlier handles are kept until they're deleted on request. There's no self-serve account deletion yet.
• On your Mac, everything stays until you delete it. The log file starts over at 5 MB, keeping one older copy.