Privacy and security

This page lists what Cuewire keeps on your computer, what it may send, and how it protects keys, passwords and messages.

Figure: Your work stays on your computer. Only the items on the right may leave it, and only as described here.

What stays on your computer

Cuewire works without an account. It never sends your code, prompts, file names, notes or messages anywhere. Your canvases, notes and settings are files in Cuewire’s folder on your computer. For remote projects, the canvas is also kept on the host.

The agents talk to their own providers with your own logins. Cuewire never sees, proxies or stores those logins.

What Cuewire sends

Press Ctrl+K (Cmd+K on a Mac) and choose Privacy settings…. The Privacy sheet opens. There you choose what Cuewire may send, and see exactly what is waiting to go.

Figure: The Privacy sheet. Everything waiting to be sent is listed in words.

• Send a crash heartbeat (on unless you turn it off): for each session, whether it ended cleanly, with the version and the operating system. It tells us when a release crashes more than the last one, so that release can be stopped.
• Share usage events (off unless you turn them on): which features are used, as counts and set values such as “an agent started”. Times are rounded to the hour. Never names, paths or text.

Neither carries an account, a device id or anything else that says who sent it. The service keeps only totals.

• Waiting to be sent lists every item not sent yet. Delete what is waiting deletes them.
• Turning a switch off deletes what of it was waiting.
• Cuewire sends a minute after it starts, then every six hours.
• If your organisation turned something off, the sheet says Your organisation turned this off.

What Cuewire reads

• The agents’ local usage logs: Claude Code’s, Codex’s, Gemini CLI’s and Copilot CLI’s logs on your computer, to show token use and limits. Nothing from them leaves your computer. Set CUEWIRE_NO_USAGE=1 to turn this off.
• Your login shell’s environment, on remote hosts: so the agents installed there are found.

Agents reach only what you connect

An agent can see and change only what is wired to it on the canvas: other agents, notes and portals. A task’s text is typed only into terminals that run an agent, never into a plain shell. A reviewer agent runs read-only.

Agents tell Cuewire when they need you through their own hooks. Claude Code posts these events to Cuewire’s background service on your own computer (127.0.0.1). Each post carries its terminal’s own token. Posts without one are refused.

Your account

You need an account only for the paid plans. When you sign in, the Cuewire service keeps:

• your email address, to send you sign-in codes and invitations;
• the names of the computers you signed in on (up to 5);
• your plan, and your organisation if you are in one.

Sign-in codes and sessions are stored on the service only in a scrambled form (as hashes). Your session on your computer is in the system keychain. Paddle, our payment provider, takes payments. Cuewire never sees your card details.

Keys and tokens

API keys and endpoint tokens you give agent accounts are kept in your system’s keychain, never in a file. That is Credential Manager, Keychain or the Secret Service. The same goes for your sign-in, your sync code and each companion pairing’s key.

Synced settings

Settings sync encrypts your settings on your computer with your sync code. The service stores only the encrypted copies and can’t read them. Keys and tokens never sync.

Roles and arrangements your organisation shares are different. The service can read those. See Teams and organisations.

The companion

What your phone and desktop say to each other is end-to-end encrypted. The relay in between sees only an anonymous channel id and when messages pass. It can’t read them, and it keeps nothing. Notifications are encrypted for your phone’s browser, so its push service can’t read them either. See Your phone as a companion.

Remote hosts

• Server uploads: Cuewire uploads only the server files this build signed. Each file’s checksum is checked on the host before it is used.
• Passwords and passphrases: these go straight to SSH. They pass through a connection on your own computer (127.0.0.1) that only the SSH session Cuewire started can use. They are never stored or logged.
• Folders: the host lists only folders inside the folders it allows (your home folder unless configured otherwise), and never follows symbolic links.

Support files

Press Ctrl+K and choose Report a problem…. Cuewire builds a support file and shows it to you in full before it goes anywhere. It holds:

• the version and platform;
• the last crash, if any;
• the end of Cuewire’s logs, which never contain terminal output, prompts or notes.

Your home folder, your name, email addresses and anything that looks like a key are taken out.

Figure: Report a problem. Read the file, then save or copy it.

Nothing is sent from the app. Click Save to a file, Copy or Show in folder, then attach the file yourself.

The audit log

Cuewire keeps a record of security-relevant actions on your computer, such as agents started and companions paired. It never holds prompts. See For administrators.

Reporting a security problem

To report a security problem, contact the maintainers privately before you publish anything.

What’s next

• For administrators: policies, the audit log and deploying Cuewire.
• Your phone as a companion: how pairing works.
• Settings sync: how synced settings stay private.