Privacy policy

Cue is an AI email client operated by [OPERATOR LEGAL NAME] ("we", "us"), [OPERATOR ADDRESS]. Cue is in private beta. This policy explains what data Cue handles, why, and what control you have.

• Cue reads your mail and calendar to show what needs a reply, write draft replies, prepare briefs and answer your questions.
• We do not sell your data, show ads, or use your Google data to train AI models.
• Drafts are not sent unless you send them, or you set up an automation rule that does.
• You can disconnect or delete your account at any time.

• Account details. Your name, email address and profile picture from Google or Microsoft when you sign in, and the address you enter when you request access. Used to run your account and manage who is invited to the beta.
• Mail data. Messages, threads, labels, attachments and drafts in your connected mailbox. Used to show your inbox, find what needs a reply, write drafts, categorize mail, and run automations you configure. On our servers Cue stores message metadata (sender, recipients, dates, read state, thread IDs). Message content is fetched from Gmail or Microsoft when needed and is kept in a local mail cache in your browser. Content can also be stored where it is part of something Cue produced for you, such as a draft, a note, a chat answer, or the reason a rule ran, and for emails you send or schedule while they are held for undo or sending. Our Redis cache holds no message content or personal data: only IDs, hashes, counters, locks and timestamps that keep sync, rate limits and background jobs running, and public news headlines about the organizations you meet, stored under a hash of the organization. Briefs, suggested replies, inbox insights and contact photos that Cue works out for you are sent to your browser and kept there, next to your local mail cache. Messages in our job queue carry the IDs, and for sorting senders the sender addresses, that a background job needs, until the job runs.
• Calendar data. Events and free/busy times, used for briefs, scheduling and availability. Cue creates or changes events only when you ask.
• Contacts. If enabled and you allow it, your saved contacts and people you correspond with, used to suggest recipients and give context about people.
• Things you create in Cue. Rules and automations, writing-style and signature settings, memories and learned reply preferences, chat history with the assistant, and other settings.
• Connected services. If you connect integrations (for example MCP servers, Slack, Notion or a separate calendar), Cue stores the connection and its access tokens, and sends those services only what a feature you use requires.
• Sign-in tokens. OAuth access and refresh tokens, so Cue can reach your mailbox without you signing in each time.
• Usage and technical data. Server logs and error details. Used to keep Cue secure and working. Cue uses essential cookies for sign-in and to remember your selected mailbox.

Google: view and manage your mail (gmail.modify: read, label, archive, create drafts, and send when you tell it to), manage basic mail settings (gmail.settings.basic), read and edit calendar events and free/busy (calendar.readonly, calendar.events, calendar.freebusy), your basic profile and email, and, if enabled, contacts (contacts, contacts.other.readonly). If you connect Google Drive for attachment filing, we also ask for access to files created by or opened with Cue(drive.file).

Microsoft (if you connect a Microsoft account): read and write your mail (Mail.ReadWrite, plus Mail.Send when sending is enabled), mailbox settings, calendars, basic profile, offline access for refresh tokens, and, if enabled, contacts and people.

We ask only for what Cue's features use. You can revoke access at any time (see below).

When a feature needs AI, Cue sends the relevant text to an AI provider's API and gets a result back: a summary, a draft, a category, an answer. What is sent depends on the feature. It can include a message or thread, calendar details, your instruction, and your saved preferences. Cue currently uses Anthropic as its primary AI provider and Google (Gemini) as a fallback.

Cue uses these providers through their APIs. We do not authorize them to train models on your data, and their API terms govern how they handle what we send.

We do not use your mail or other Google user data to develop, improve or train generalized AI models, ours or anyone else's. AI output can be wrong; see our terms.

Cue's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, for data we receive from Google APIs:

• We use it only to provide or improve user-facing features that are visible in Cue, such as showing your inbox, writing drafts and preparing briefs.
• We do not sell it, and we do not transfer it to others except as needed to provide those features (for example to the AI and hosting providers listed below), to comply with law, or as part of a merger or sale where you are told first.
• We do not use it for advertising, including retargeting or interest-based ads.
• We do not use it to develop, improve or train generalized AI or machine-learning models.
• No human reads it, except with your explicit consent for specific messages, where needed for security (for example investigating abuse or a fault in your own account), or where required by law.

These providers help us run Cue and process data on our behalf.

• Vercel: application hosting
• Neon: Postgres database
• Upstash: Redis cache (no message content) and job queue
• Anthropic: AI processing (primary)
• Google (Gemini API): AI processing (fallback)
• Google (and Microsoft, if you connect a Microsoft account): the Gmail, Calendar, Contacts and Graph APIs you authorize
• Axiom: application logs
• Integrations you connect (Slack, Notion, MCP servers and similar): only when you connect them

We may also disclose data if the law requires it. Data may be processed in the United States and other countries where these providers operate.

• Account data and mail metadata: kept while your account exists.
• Browser mail cache, and the briefs, suggested replies and insights kept with it: live in your browser and are cleared when you sign out.
• Sent-draft text captured to compare a draft with what you sent: removed after 14 days.
• AI reasoning notes on automation history: kept with that history, and we may redact them after a set period.
• Unedited AI drafts left in your mailbox: removed after the number of days in your settings (default 14).
• Send-operation records (used to prevent double sends and support undo): removed about 30 days after they finish.
• Mobile push delivery records: removed after 24 hours.
• Chat history and memories: kept until you delete them or delete your account.
• Logs: kept for a limited period by our logging provider (Axiom).
• Backups: deleted data may remain in our database provider's backups until they expire.

Deleting your account. In Settings you can delete your account. This removes your Cue data and stops mailbox notifications. You can also delete a single connected mailbox.

Disconnecting. You can remove Cue from your Google account's third-party access settings or your Microsoft account's app permissions at any time. Cue then loses access to the mailbox. Use Settings to delete the data we hold.

Traffic uses HTTPS, OAuth tokens are encrypted before they are stored, and mail content is fetched on demand rather than copied wholesale into our database. No system is perfectly secure, and Cue is run by one person during the beta, so we cannot promise enterprise-grade controls. Tell us promptly if you suspect a problem.

Depending on where you live (for example the EU or UK under GDPR, or California under CCPA/CPRA), you may have the right to access, correct, delete or export your personal data, to restrict or object to its use, and to withdraw consent. We do not sell or share personal data for advertising. You can delete your account yourself in Settings. For anything else, including an export, email us and we will respond within 30 days. You may also complain to your local data protection authority.

Where GDPR applies, our legal bases are performing our contract with you (running Cue), your consent (connecting your accounts), and our legitimate interests (security and improving Cue).

Cue is not for anyone under 16. We do not knowingly collect data from children. If you believe we have, contact us and we will delete it.

We may update this policy. For material changes we will tell you in the app or by email before they take effect. The effective date above shows the latest version.

[OPERATOR LEGAL NAME], [OPERATOR ADDRESS]
Email: [PRIVACY CONTACT EMAIL]