Privacy Policy

01The short version

• Your meetings (write-ups, transcripts, the questions you asked, marks, and folders), meeting briefs and prep answers, your memory (the people you write to, facts, promises, and your writing style and samples), your chats with Cue, and your drafts and dictation history are kept in your Cue account, encrypted with a key unique to your account, so they are on every device you sign in on. Our servers can open them, to sync them between your devices and to run the features you use. This is not end-to-end encryption.
• Audio recordings, screen summaries and what Cue noticed on screen, reference material you paste in, the search index, your on-device usage and diagnostics, and the log of actions Cue took stay on your device.
• Nobody at Naberhub looks at your cloud copy. If support ever needs to, we ask you first, and that access is time-limited and logged. Every read by our service is logged. We never use it to train models.
• You can download all of it at any time from your account page. Local mode (in Settings on your Mac or iPhone, or on your account page) deletes the cloud copy within 24 hours, backups included, and keeps everything on your devices. Deleting your account deletes it the same way.
• New accounts start with the cloud copy on and are told so once. If your account existed before the cloud copy, Cue asks you once, and nothing is uploaded until you answer.
• To draft, answer, transcribe, and search on your behalf, the app sends only the specific text, screenshot, or audio needed for that request to our AI providers over a secure connection. It is processed to produce a result and is not kept in a durable store by us: while a request runs, its working state is held in temporary storage and deleted when the request finishes, and a request that pauses for you expires automatically after at most one hour.
• Deep research is the one request whose result we hold for a while. When you ask Cue to research something, the job's working data (its plan, search results, the text of the pages it read, and the evidence taken from them) is held for at most 24 hours and deleted as soon as the report is written, and the report is held for at most 72 hours, until your app has it, then deleted.
• We rely on named third-party providers, listed below, to run the models, transcription, sign-in, payments, and hosting. Composio, Clerk, Stripe, Upstash, and Vercel maintain SOC 2 Type II reports. Naberhub's own SOC 2 program is in progress.
• We keep the minimum needed to run accounts and billing: your email, your subscription status, and a count of how many AI actions you have used (a number, not the content of those actions).
• Live conversation is the one exception to everything going through our backend: while a live conversation is open, your microphone audio streams from your device directly to a realtime voice provider. It does not pass through our servers. Cue names that provider and asks for your permission before the first one, and you can withdraw it at any time in Settings or Privacy.
• If you connect another tool (like Google Calendar or Slack), our managed-connections provider securely holds the access token on your behalf so Cue can read the context you asked for, until you disconnect it. Cue reads on its own; anything that would send, post, change or create something through a connected tool is shown to you first and happens only when you approve it in the app. Cue never sends, posts or changes anything without your click, and never deletes anything on your behalf.
• We do not sell your information and we do not use it for advertising. We reach every AI provider through its paid business API, whose published terms say customer content is not used to train models, and we never use your content to train anything ourselves.

02What is kept in your Cue account

Unless you use local mode, the following is kept in your Cue account as well as on your devices, so it is on every device you sign in on:

• Your meetings: their write-ups, transcripts, the questions you asked about them, the moments you marked, and your folders.
• Meeting briefs and the answers you gave while preparing for a meeting.
• Your memory: relationship cards (the people you write to), memory facts, tracked promises, and your writing style and the samples Cue learned it from.
• Drafts Cue has written, and your dictation history.
• Your chats with Cue: what you typed or said to Cue and what it answered. An answer can include what Cue looked up for you, like an email, a calendar entry or text on your screen.

How it is protected. Your cloud copy is encrypted at rest with AES-256-GCM, using a key unique to your account, which is itself encrypted by a master key held by our service. It is stored in the United States, in a Postgres database run by Neon on Amazon Web Services. Because our service holds the keys, it can open your data, to sync it between your devices and to run the features you use. It is not end-to-end encrypted. Nobody at Naberhub looks at it. If support ever needs to, we ask you first, and that access is time-limited and logged. Every read by our service is logged. We never use it to train models.

Your choices. New accounts start with the cloud copy on and are told so once. If your account existed before the cloud copy, Cue asks you once, and nothing is uploaded until you answer. You can download all of it at any time from your account page, as a JSON file. Local mode, in Settings on your Mac or iPhone or on your account page, deletes your cloud copy within 24 hours, backups included. Everything stays on your devices, and they stop sharing notes and memory with each other. Deleting your account deletes the cloud copy the same way.

03What stays on your device

The following is created and stored on your device, in a local database, and is not kept on our servers:

• Meeting recordings, kept for the period you choose in Settings (30 days unless you change it). They are sent to be transcribed, as described below, and never stored on our servers.
• Dictation audio clips, kept alongside your recent drafts so a draft can be transcribed again.
• Your screen-activity work log (summaries of what was on screen) and the things Cue noticed on screen.
• Reference material you paste into Cue.
• The search index Cue builds over your memory, your on-device usage and diagnostics, and the log of actions Cue took for you.
• Your settings, personal dictionary, and quick commands.

You can view, edit, and delete your data at any time inside the app. Screenshots are sent with screen questions by default, so answers can use what is on screen; you can turn this off in Settings, and a screenshot is deleted from our temporary storage when its request finishes.

When you ask Cue to act on your Mac, macOS asks you first: before Cue controls another app, like making a note in Notes or running a script you approved, and before it opens your Desktop, Documents or Downloads folder, the only folders its file actions can use. A file’s contents are sent only when the action you asked for needs them.

04What we collect, and why

Account information. When you sign in, our authentication provider collects your email address and basic sign-in metadata so we can create your account and issue the secure tokens the app uses. We use this to operate your account and contact you about the service.

Billing information. Paid plans are processed by our payment processor, which collects and stores your payment details; Naberhub does not see or store your full card number. We keep your subscription tier and status so we can provide the plan you paid for.

Usage metering. We count how many cloud AI actions you take in a billing period to enforce plan limits. This is a tally by count, not a record of what you wrote or asked.

Request content (transient). When you use a cloud feature, the app sends the text or audio that feature needs (the message you’re drafting, the screen text you asked about, or a voice clip to transcribe) to our AI providers to generate the result. We do not keep a durable copy of your request content. While a request runs, its working state (which can include the screen text or screenshot it was given) is held in temporary storage so a multi-step action can continue, and it is deleted when the request finishes. A request that pauses to ask you something expires automatically after at most one hour.

Deep research. When you ask Cue to research something, we send your question and the searches planned for it to our managed-connections provider, which runs them with its search provider and reads the pages they find; the text of those pages goes to our AI provider to take evidence from them and write a report that cites them. A research job never uses your connected accounts or anything on your Mac. Its working data is held for at most 24 hours and deleted once the report is written; the report is held for at most 72 hours, until your app has it, and then deleted.

Website. The cuebar.app site uses only the cookies necessary for sign-in and security, plus privacy-friendly, cookieless analytics (aggregate page views and performance) that does not track you across sites. We do not run third-party advertising or cross-site tracking.

05When you connect other tools

Cue can connect to tools you already use (for example Gmail, Google Calendar, Google Drive, Google Docs, Google Sheets, Outlook, Slack, Notion, Linear, Jira, or GitHub) so it can read the context you ask it to use. Connecting is optional, and you start it from within the app.

When you connect a tool, the sign-in (OAuth) and the resulting access token are handled and stored by our managed-connections provider, acting on your behalf; we do not hold that token ourselves. Cue reads from a connected tool through that provider’s secure gateway only to fulfill a request you make, and the content it retrieves is passed to our AI provider to generate the result and is not kept in a durable copy. Reading runs on its own. Anything that would send, post, change or create something through a connected tool is shown to you first, item by item, and runs only once you approve it in the app: Cue never sends, posts or changes anything without your click. Deleting, trashing and cancelling through a connected tool are blocked. You can disconnect at any time from the app, which revokes the connection and its stored token. Deleting your account disconnects every connected tool for you.

Web search and browsing. When you ask Cue to look something up or research on the web, your query, and the content of any page it fetches to answer, are processed by our AI provider, and for some requests through the same connections provider, to produce the answer. Our AI provider may run your query as a Google Search, and an answer found that way is shown with Google’s search suggestions, which link to Google. This does not require connecting any account.

06Service providers

We rely on a small set of processors, each handling only what their function requires. They are contractually limited to using your information to provide their service to us:

• Google (AI model provider): runs the models that draft, answer, summarize, and plan, through the Gemini API, and may ground an answer in Google Search. Receives the field text, on-screen text, screenshots, thread context, and selected memory a request needs. Reached through our backend.
• Anthropic (standby AI model provider): receives nothing in normal operation. If we move Cue's models back to it, it receives what the Google entry above describes, in the same way.
• Groq (speech-to-text provider): transcribes voice dictation and meeting audio. Receives the audio clip and returns text. Reached through our backend, which keeps neither the clip nor the text.
• Google (text-to-speech provider): turns an answer into speech. Receives the answer text to be spoken. Reached through our backend.
• Google (realtime voice provider): runs live conversation. Receives your microphone audio continuously while a live conversation is open. Your device connects to it directly on a short-lived token our backend issues, so this audio does not traverse our servers.
• Composio (managed-connections provider): manages the secure connections to any tools you link (handling the OAuth sign-in, custodying the access tokens on your behalf, and running the gateway Cue reads through) and powers web search, page browsing, and the searches and page reading of deep research. Receives the requests needed to read the tools you connected or the searches you asked for, and for deep research your question, the searches planned for it, and the addresses of the pages it reads.
• Clerk (authentication provider): account identity and sign-in (your email, name, and sign-in metadata).
• Stripe (payment processor): subscription payments and card processing. We never see your card number.
• Neon (database provider): stores your cloud copy, encrypted with a key unique to your account, in the United States on Amazon Web Services. The keys that open it are held by our backend, not by Neon.
• Upstash (infrastructure provider): short-lived auth codes, token rotation, usage counters, the working state of a request while it runs (deleted when it finishes, and after at most one hour for a request paused for you), a record of each change Cue made in a connected account with your approval (the ids it changed and what puts it back, kept 24 hours for Undo, and its kind and count, kept 7 days, never the content), the older end-to-end encrypted memory sync used only by earlier app versions that turned it on, Mac app crash reports (stack frames and version numbers, stored by crash signature rather than by user, for 92 days), a deep research job's working data (at most 24 hours) and its report (at most 72 hours, until your app has it), and waitlist or contact submissions.
• Vercel (hosting and analytics provider): hosts the website and backend that route your requests, runs deep research jobs in the background (keeping a record of each run, its id, steps and any errors, never your report or the pages read, for 7 days), and provides the cookieless website analytics.

We reach every AI provider through its paid business API, whose published terms say customer content is not used to train models, and we never use your content to train anything ourselves.

Composio, Clerk, Stripe, Upstash, and Vercel maintain SOC 2 Type II reports. Naberhub’s own SOC 2 program is in progress. Business customers who need advance notice of a change of provider can ask for that in writing: email hello@cuebar.app.

07Live conversation: your voice does not pass through us

Every other cloud feature in Cue reaches a provider through our backend. Live conversation does not. When you open one, your device opens a connection to a realtime voice provider and streams your microphone audio to it directly, using a short-lived token our backend issues for that session. Cue names that provider in the app when it asks you to allow the first one. Naberhub never receives that audio, and we cannot see or store it. What you say and what Cue answers is kept as a written transcript in your chats with Cue, on your device and, unless you use local mode, in your Cue account, like the rest of your chats.

Because of that, live conversation is consent-gated. Cue asks you before the first live conversation on your account, tells you where the audio goes, and does nothing further if you decline. Your answer is stored with that account’s settings on your own device, so a second account on the same Mac is asked separately. You can withdraw consent at any time in Settings or Privacy, which ends any conversation in progress. The microphone runs only while a conversation is open, and stops the moment you end it. Dictation, drafting, and your memory are unaffected: they are handled as described above.

08International transfers

Naberhub Inc. is incorporated in Ontario, Canada. Some of our service providers process data on servers located in the United States or other countries. Where information is transferred outside Canada, we use providers that apply comparable safeguards, and that information may be subject to the laws of the countries where it is processed.

09How long we keep it

• Account and subscription data: for as long as your account is active, and for a reasonable period afterward to meet legal, tax, and accounting obligations.
• Usage counters: reset each billing period; historical tallies are kept only as needed for billing.
• Your cloud copy (meetings, briefs, memory, drafts, dictation history, and your chats with Cue): kept while your account uses it. Turning on local mode, or deleting your account, deletes it within 24 hours, backups included.
• Answers Cue found with Google Search: kept in your chats for at most two years, then removed, as Google's terms require.
• Request content: not kept in a durable store. A request's working state is held in temporary storage while it runs and deleted when it finishes; a request that pauses for you expires after at most one hour.
• Deep research: a job's working data for at most 24 hours (deleted once its report is written), its report for at most 72 hours (deleted once your app has it), and the record of the run on our hosting provider for 7 days.
• Meeting recordings and dictation audio: kept on your device, never on our servers, for the period you choose in Settings (meeting recordings default to 30 days).
• Live-conversation audio: never received by us, so we keep none of it. It is handled by the realtime voice provider under its API data policies for the life of the session. The written transcript is kept with your chats with Cue.
• Connected-tool tokens: kept (encrypted) until you disconnect that tool, then revoked and deleted.
• Contact form and waitlist submissions: kept for 90 days so we can reply or let you know when something you asked about ships, then deleted.
• On-device data: retained on your device until you delete it or remove the app, entirely under your control.

10Security

Connections between the app and our backend use TLS. Secret keys (our AI provider keys) live only on our servers and are never sent to the app. Your cloud copy is encrypted at rest with a key unique to your account; the keys that open it are held by our backend, never by the app or the database provider, and every read is logged. Your audio, your screens, and the other data listed under “What stays on your device” are not kept on our servers at all.

11Your rights

Under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable law, you may:

• Access the personal information we hold about you and ask how it is used.
• Correct information that is inaccurate or incomplete.
• Withdraw consent and close your account, subject to legal and contractual limits.
• Download a copy of your meetings, notes, and memory at any time from your account page.
• Ask us to delete your account information. Deleting your account from the app deletes your cloud copy within 24 hours, backups included; what stays on your device is deleted when you delete it there.

To exercise any of these, email hello@cuebar.app. We will respond within the timeframes required by law.

12Children

Cue is not directed to children and is not intended for anyone under the age of majority in their jurisdiction. We do not knowingly collect information from children.

13Changes to this policy

We may update this policy as the product evolves. We will revise the “Last updated” date above and, for material changes, provide notice through the app or the website. Continuing to use Cue after an update means you accept the revised policy.

14Contact

Naberhub Inc. is responsible for the personal information under its control and has designated a contact for privacy questions. Reach us at hello@cuebar.app.