Cue — Privacy Policy

1. Scope

This policy covers the Cue Chrome extension (published on the Chrome Web Store under the name “Cue — Real-Time Conversation Intelligence”), the companion Progressive Web App at cue-pwa.vercel.app, and the iOS/watchOS companion apps (when available).

2. What Cue Does NOT Collect or Transmit

We do not collect, process, transmit, store, or disclose any of the following:

• Audio. Your microphone feed is analyzed in real time inside your own browser. The raw audio samples never leave the audio processing thread. No recording is made, no file is written, no stream is uploaded.
• Speech-to-text or transcripts. Cue does not convert speech to text. We do not run speech recognition. We do not call any cloud transcription API.
• Conversation content. Cue cannot see the words you or anyone else speak. Only acoustic signal features (volume, pace proxy, spectral characteristics) are computed, and those features are discarded frame-by-frame.
• Personally identifiable information (PII). Name, address, phone number, location, IP address (beyond ephemeral request-handling), device identifiers, browser fingerprints, and network information are not collected.
• Financial information beyond payment-processor handoff. Cue never sees your card number or bank information — that is handled by Lemon Squeezy (see section 11).
• Web history or browsing activity. We do not track which sites you visit or what you do on them.

3. What Cue DOES Process (Locally Only)

The following data is processed entirely on your device and never transmitted by Cue's default behavior:

• Microphone audio, captured via the browser's standard getUserMedia API, processed in an AudioWorklet in real time.
• Acoustic features derived from the audio: root-mean-square amplitude, zero-crossing rate, spectral centroid, spectral flatness, and voice-activity flags. Each feature is a single numeric value per 128-millisecond frame.
• Session telemetry: your personal calibration baselines, nudge firing times, session duration, and aggregated per-session metrics (number of nudges, average pace, average vocal edge, Listening Score). Written to your browser's local IndexedDB and chrome.storage.local (extension) or localStorage (PWA). Remains on your device.
• User preferences: nudge style, coaching intensity, conversation profile, thresholds — all stored locally.
• Pro license token (if Pro is activated): a signed JWT issued by cue-pwa.vercel.app/api/license, verified locally on every session start using a public key embedded in the extension/PWA. The JWT carries your email and expiration claim. Stored in chrome.storage.local / localStorage; never transmitted after activation.
• Anonymous device ID (only if you opt in to the Listening Corpus, see section 5): a randomly generated UUID, stored locally. Never linked to your name, email, or any other identifier.

4. Optional Cross-Device Sync

Cue offers an optional cross-device sync feature that allows preferences and session summaries to sync between the Chrome extension and the Cue iPhone PWA. Push notifications can also be received on Apple Watch via standard iOS notification mirroring (configured by the user in the iOS Watch app, not by Cue). This sync feature is off by default and requires the user to explicitly enter an email address in Settings.

When enabled, Cue transmits only:

• The email address the user provided.
• Preference values (e.g., “nudge pack: gentle”).
• Session summaries: session ID, start/end timestamps, duration, nudge count, average pace and vocal edge values — all numeric aggregates, never audio, never per-signal-frame detail.

Sync transmits via HTTPS to cue-pwa.vercel.app/api/sync and the resulting data is stored in an Airtable record keyed by the user's email. Users may disable sync at any time by clearing the email in Settings. Users may delete all synced data by contacting vajdos@gmail.com.

5. Optional Listening Corpus Contribution

Cue offers an optional “Help improve Cue” toggle (extension Settings, PWA Settings → Privacy & settings). This feature is off by default and only activates when the user explicitly toggles it on.

When enabled, Cue sends one anonymized record per corrective nudge to cue-pwa.vercel.app/api/corpus. The full record contents:

• device_id — a randomly generated UUID stored only on the user's device. Not linked to email, name, IP, or any other identifier. Rotates if the user clears local data.
• source — one of extension / pwa / desktop.
• nudge_type — one of pace / tension / long_speech / escalation / trial_cap.
• scores_at_fire — three integers 0–100 (acoustic signal levels at the moment of the nudge).
• responded, time_to_correction_sec, response_window_sec, resolution — whether the user adjusted their behavior in the 15-second window after the nudge.
• nudge_number, timestamp, extension_version.

Never sent: audio, transcripts, email, name, IP address (server logs include the request IP for the duration of the request but it is never stored in the corpus record itself), browser fingerprint, or anything the user said. The schema is strictly enforced server-side; unknown fields are rejected.

Users may opt out at any time by toggling the setting off; from that moment, zero further corpus traffic is sent. Users may request deletion of past corpus records by contacting vajdos@gmail.com with the last 8 characters of their device ID (visible in the Settings UI when opted in).

6. Pro License Activation

Cue offers an optional paid “Pro” tier. The activation flow contacts Cue's server only when the user clicks Activate:

1. User pays via Lemon Squeezy (see section 11).
2. User clicks Activate in Settings (extension or PWA) and enters the email they used at checkout.
3. Extension/PWA POSTs the email (and order ID, if available) to cue-pwa.vercel.app/api/license.
4. Cue's server looks up the email in Airtable, confirms Pro status, and returns a signed ES256 JWT.
5. Extension/PWA verifies the JWT signature locally using an embedded public key, then stores the token in local storage.
6. Pro features check the stored JWT on every session; expired or tampered tokens fail closed.

Once activated, no further network traffic occurs until token expiry (~370 days). Users may revoke their token at any time by clicking Sign out in the PWA Settings or by clearing local data in the extension.

7. Optional Push Notifications (PWA only)

If a user installs the Cue PWA and enables push notifications, Cue stores the resulting Web Push endpoint (a browser-provided URL) in order to deliver nudge notifications. The endpoint does not contain user-identifying information — it is a cryptographic token issued by the user's browser. Users may revoke push permissions at any time in their OS settings.

8. Permissions Declared by the Chrome Extension

The extension declares the following permissions in its manifest. Each is used only for the purpose described; no permission is used to collect, derive, or transmit personal data beyond what is disclosed in this policy.

• activeTab — to detect when the user is on a supported video-call website so Cue can adapt its UI.
• tabs — to auto-start Cue on supported call URLs.
• storage — to save session history, user preferences, and (if Pro is activated) the signed license token locally in the browser.
• alarms — to keep the extension's background service worker responsive during long calls.
• notifications — to deliver nudge alerts when the user is viewing another tab.
• contextMenus — to provide right-click access to Cue settings, progress, and the verification tool.
• sidePanel — to display the always-on coaching widget in Chrome's side panel.
• offscreen — required by Chrome Manifest V3 for continuous audio processing in an offscreen document.
• tabCapture — optional; used only when the user explicitly selects the “Them” or “Both” source mode, to analyze the remote participant's audio from the active call tab. Tab audio is processed locally on the same terms as microphone audio — never recorded, never uploaded.

9. Data Retention

Locally stored session history is capped at 20 recent sessions. Older sessions are pruned automatically. Users may clear all Cue data at any time by opening Chrome Settings → Privacy & Security → Clear Browsing Data → Cookies and other site data, or by removing the extension. PWA users may clear all data via Settings → Privacy & settings or by removing the PWA from their Home Screen.

Intervention-log records (for users who have the v1.0 Decision Engine enabled) are capped at 500 records locally and may be exported as CSV or cleared from the extension's Settings page.

Server-side Airtable retention: opt-in corpus records, sync records, and Pro/payment records are retained for the lifetime of the account. Users may request deletion at any time via the contact in section 14.

10. Server-Side Endpoints Cue May Contact (And When)

For full transparency, the complete list of server endpoints Cue may contact and the precise trigger for each:

• /api/license — only when the user clicks Activate in Settings. Carries the user's email and (if available) order ID. See section 6.
• /api/corpus — only when the user has opted in via Help improve Cue AND a corrective nudge fires. One fire-and-forget POST per resolved nudge. See section 5.
• /api/sync — only when the user has entered an email in Settings → Cross-Device Sync. See section 4.
• /api/signup — only when the user submits the email signup form on the PWA. Rate-limited.
• /api/upgrade-pro — only when the user clicks Activate on the post-payment thanks page. Verified server-side against Lemon Squeezy's order API when configured.
• /api/lemonsqueezy-webhook — receives signed payment events from Lemon Squeezy's servers (not the user's browser). Used to automatically mark Pro and send the welcome email.
• /api/test-haptic, /api/push-subscribe — only when the user enables haptic notifications.

No other server contact is initiated by the extension or PWA in the default state.

11. Third-Party Services

Cue uses the following third-party services, each only in the contexts described:

• Vercel — hosts cue-pwa.vercel.app and the server endpoints listed in section 10. Vercel's privacy policy applies to requests made to this domain.
• Airtable — stores opt-in sync records, signup records, corpus records (anonymized by device ID), and Pro entitlement state keyed by email. Airtable's privacy policy applies.
• Resend — sends welcome emails and weekly digest emails for users who signed up or paid via the PWA. Resend's privacy policy applies.
• Lemon Squeezy — processes payments for the Pro subscription. Lemon Squeezy is the payment processor and merchant of record; Cue never sees your card number, bank details, or other financial information. Lemon Squeezy's privacy policy applies to payment data.
• Web Push infrastructure — browser-provided push servers (FCM for Chrome/Android, APNs for Safari/iOS) deliver push notifications to users who opted in.

12. Children's Privacy

Cue is not directed at children under 13. We do not knowingly collect any information from children under 13.

13. Changes to This Policy

If this policy changes, the updated version will be published at this URL with a new “Effective” date. Material changes will be announced in the Chrome Web Store listing and within the extension itself. Continued use of Cue after a change constitutes acceptance of the updated policy.

14. Contact

Privacy questions, data-deletion requests, or corpus device-ID lookups: vajdos@gmail.com

Cue is operated by Nathan Vajdos (sole proprietor, United States).

15. Verification

Because Cue operates under a privacy architecture rather than a privacy policy alone, the claims above are externally verifiable:

1. Open Chrome DevTools (F12) → Network tab while Cue is running a coaching session. The default state (no opt-ins, no Pro activation) shows zero outgoing requests from the extension during a session.
2. If you have enabled an optional feature (corpus, sync, push), you will see exactly the endpoints listed in section 10 and only those.
3. Inspect the extension's manifest at chrome-extension://[id]/manifest.json. The manifest declares only one host_permissions entry: cue-pwa.vercel.app.
4. The extension source code is auditable; request a copy by email.