Privacy Policy

Effective August 2, 2026

The short version. The Cue is built to know as little about you as possible. Your profile, your keys, and your saved scenes stay on your phone, encrypted on the device itself. There are no accounts, no ads, no tracking, and no analytics. Messages to your partner are encrypted on your phone before they are sent, pass through our relay as unreadable ciphertext, and are deleted the moment your partner's phone collects them — we cannot read them. The only content that ever leaves your phone in readable form is what you send to our AI provider if you subscribe and turn on Enhanced scenes, and nothing about that is stored afterward.

1. What The Cue stores on your device

Everything The Cue needs lives locally on your phone, encrypted at rest:

Your display name and the password-derived keys that lock the app;
The cryptographic keys of partners you've paired with in person;
Your messages and your saved (favorite) scenes;
Your preferences and settings.

We never receive, upload, or back up any of this — with the single exception described in section 2, where a pairing request carries your display name and public key to the partner you are pairing with. If you uninstall the app, everything stored on the device is gone.

2. Pairing and messaging

Pairing. You pair by scanning a QR code — in person, or from a photo you send however you like. The keys themselves are exchanged through that code, never generated or held by us. Sending a pairing request passes your display name and public key through our relay so the other phone can show you who is asking; that request is deleted as soon as it is accepted or declined. Both phones then display a matching safety number you can compare out of band — read it aloud, or check it in person — to confirm nobody substituted a key in transit.

Messages. Your messages are end-to-end encrypted on your phone before they are sent. They travel through a relay we operate (Google Firebase), which holds the encrypted message only until your partner's phone collects it and then deletes it. We cannot read your messages. The relay only ever handles ciphertext, and the keys that decrypt it exist solely on your two devices — there is nothing readable for us, for Google, or for anyone else to access or hand over. We do not store message content.

Notifications. To wake your partner's phone we send a silent push carrying no message content, no sender name, and nothing identifying — just a signal to check for mail. For that we store a notification token for the device, filed under a one-way hash of your public key.

3. Enhanced scenes and Venice AI (optional, subscribers only)

The Cue can generate scenes in two ways. By default, and always on the free tier, scenes are generated entirely on your device — nothing is transmitted anywhere.

If you subscribe to The Cue Premium and enable Enhanced scenes, then each time you generate a scene your selections — the categories, preferences, any names you enter, anatomy selections, and any special request text — are sent over an encrypted (HTTPS) connection to our AI provider, Venice AI, which writes the scene and returns it. This is processing by a service provider on our behalf. We do not store this information on any server, and it is used only to produce your scene. Venice processes the request under its own privacy policy. If you prefer that nothing ever leaves your phone, keep Enhanced scenes off and use on-device generation.

4. Subscriptions and payments

The Cue Premium is an auto-renewing subscription sold through Google Play. All payment is handled by Google — we never receive or store your payment details. We only learn, through Google Play's billing system, whether your subscription is currently active so we can unlock Enhanced scenes.

5. No ads, no tracking, no accounts

The Cue contains no advertising, no advertising identifier, no third-party analytics, and no behavioral tracking of any kind. You do not create an account, and you never sign in to a service of ours — your in-app password is a local key, not an account.

6. Children

The Cue is intended only for consenting adults 18 years of age and older. It is not directed to children, and we do not knowingly collect information from anyone under 18.

7. Security

Messages are encrypted with NaCl/libsodium — Curve25519 key exchange with XSalsa20-Poly1305 — before they leave your phone, so the relay never sees readable content. On-device data is encrypted with AES-GCM under keys protected by the Android Keystore, the app can be locked with your password or biometrics, and its screens are marked secure so content doesn't appear in screenshots or the app switcher. No system is perfectly secure, but The Cue is designed so that even we cannot access your content.

8. Data retention and deletion

Everything The Cue stores — your profile, keys, messages and saved scenes — lives on your device, so you control it entirely. Messages can be set to auto-delete on a timer, saved scenes can be removed in the app, and uninstalling The Cue erases all of it. A message in transit sits on our relay only until your partner's phone collects it, encrypted the whole time, and is deleted on delivery; a pairing request is deleted when it is answered. We keep no readable copy of anything.

9. Changes

If we update this policy, we'll revise the effective date above and post the new version here.

10. Contact

Questions about privacy? Email support@cypresstech.net or see the Support page.

This document is provided for transparency and is not legal advice.