Privacy Policy

Product: curlyCue (macOS desktop application)

Website: https://curlycue.app

Last updated: September 17, 2026

This Privacy Policy explains how curlyCue (“curlyCue”, “we”, “us”, or “our”) collects, uses, discloses, and protects information when you use:

• the curlyCue macOS desktop application, and
• this website (collectively, the “Service”).

curlyCue is designed as a local desktop application. Most processing happens on your Mac. When you connect curlyCue to Google, the app uses Google APIs only with your consent.

1. Who we are

Controller / Owner: Joyce Ciesil

Contact email: support@curlycue.app

2. What this policy covers (and what it does not)

This policy covers information processed:

• in the curlyCue macOS app;
• in connection with Google services you choose to connect (Google Sheets / Google Drive) via curlyCue; and
• when you visit https://curlycue.app.

This policy does not cover:

• QLab (a product of Figure 53, LLC) or any third-party tools you use alongside curlyCue;
• Google’s own products and privacy practices (see Google’s policies for those).

3. Definitions

For clarity:

• “Personal data” means information that identifies or can reasonably be linked to an identifiable person (such as an email address).
• “Google data” means information received from Google APIs that you authorize curlyCue to access (for example, a selected Google Sheet’s file ID, title, tab metadata, and cell values).
• “Device data” means information stored locally on your Mac (for example settings files, logs, and backups).

4. High-level summary (for convenience)

• curlyCue is primarily a local desktop app.
• If you connect Google, curlyCue uses Google OAuth and requests one per-file scope to:
  • let you choose a Google Sheet through Google Picker in your default browser, and
  • read and write data in that explicitly selected spreadsheet for syncing.
• OAuth tokens are stored locally in the macOS Keychain.
• We do not sell personal data and do not use Google data for advertising.
• If you purchase a monthly or yearly subscription, a licensing server may store your email address, subscription information, and license status.

5. Information we collect / process

5.1 Information you provide directly (within the app)

Depending on how you use curlyCue, you may provide or create:

• Configuration and preferences, such as mapping choices, cue formatting preferences, start row/column settings, and project settings.
• Identifiers and references needed to operate the app, such as spreadsheet IDs, selected worksheet/tab names, QLab workspace IDs, and local file paths for CSV exports/backups.

We use this information only to provide the Service.

5.2 Information from Google (when you connect a Google account)

With your explicit consent via the Google OAuth consent screen, curlyCue may access:

• the file ID of the Google Sheet you explicitly select through Google Picker;
• the selected spreadsheet’s title and tab metadata, such as tab titles, numeric tab IDs, order, and hidden status; and
• Google Sheets content for the selected spreadsheet, to read and write cue-related data.

curlyCue does not request separate Google identity, email, or profile scopes. Google Picker displays the Google account used for selection in your default browser, but curlyCue does not receive your Google account email address through its requested scope.

Details on scopes and usage are in Section 8.

5.3 Local application data and logs

curlyCue may generate local data on your device, such as:

• settings and project files, which may contain the selected spreadsheet ID and tab name, column mappings, local file paths, QLab workspace identifiers, and QLab connection settings;
• short-lived in-memory caches of spreadsheet headers, rows, and tab metadata to improve performance;
• local CSV snapshots or backups when backups are enabled;
• logs containing operational details (for example, spreadsheet IDs, tab names, error messages, and diagnostic context).

These files are stored on your Mac and are not automatically sent to us.

5.4 Website data (when you visit curlycue.app)

If you visit the website, the site host may collect standard web server logs, which can include:

• IP address,
• browser type,
• device/OS information,
• referring page,
• timestamps,
• and requested pages.

We do not intentionally deploy behavioral advertising trackers at this time. Your hosting provider may still log basic access information.

5.5 Licensing and purchase records (if you purchase a license)

curlyCue offers monthly and yearly subscriptions. If you purchase a subscription, we process limited information to manage entitlement, renewals, cancellation status, license delivery, and fraud/abuse prevention. Both billing options provide the same licensed features and one user seat.

Licensing backend (“curlyCueSERVER”)

The licensing backend is implemented as a Cloudflare Worker and uses:

• Cloudflare D1 (SQLite) to store license/customer records;
• Cloudflare Queues to send transactional emails asynchronously;
• a Paddle webhook endpoint to receive billing/subscription lifecycle events and issue/update/revoke licenses.

Depending on your actions (purchase, activation, resend, deactivation), the licensing backend may receive/process:

• Email address (for example for license delivery and account recovery). The customer record stores the email address encrypted and also stores a deterministic lookup value (HMAC) so we can find the customer record without storing the email address in plaintext in that record. Administrative audit records may separately contain plaintext target email addresses, administrator identities, and IP addresses for security and accountability purposes.
• Name (optional, if received from the billing provider); stored encrypted when present.
• License key (provided by you in the app). The server stores a peppered hash of the license key for lookups and stores an encrypted copy for email sending/admin support. A short hint (such as the last characters) may be stored for support usability.
• Install identifier (installId) and app version (provided by the app when activating). The server stores only a hash of the install identifier for seat counting and does not store the plaintext install identifier.
• Billing identifiers from Paddle (such as customer/subscription/transaction IDs, price ID, billing interval, subscription status, and subscription period end timestamps), as provided in Paddle webhooks.
• Paddle webhook event metadata and, where available, an encrypted copy of the complete raw webhook payload for event deduplication, processing, troubleshooting, and billing-record maintenance.
• IP address / request metadata may be used for rate limiting and may appear in administrative audit logs where available.

The licensing backend does not receive or store payment card numbers or bank details. Payment processing is handled by Paddle and other applicable payment-service providers. When license emails are issued or resent, the recipient email address, license key, and license type are placed in a Cloudflare Queue message and sent to Resend for transactional email delivery.

5.6 Support communications

If you contact us for support (for example by emailing support@curlycue.app), we will receive the information you choose to include in your message (such as your email address, the content of your request, and any attachments like logs or screenshots).

6. How we use information

We use information to:

6.1 Provide and operate the Service

• allow you to authorize Google access and choose a Google Sheet through Google Picker (if you choose);
• read cue data from your chosen data source (CSV or Google Sheet);
• synchronize cue data with QLab;
• write updates back to a selected spreadsheet when you choose to Push/Update.

6.2 Maintain, troubleshoot, and improve

• debug issues (for example by reviewing error messages you share);
• improve performance and reliability;
• maintain compatibility with macOS/QLab/Google APIs.

6.3 Communicate with you

• respond to support requests;
• send important notices (for example licensing or policy updates), if applicable.

We do not use Google data for advertising and do not sell personal data.

7. How we share information

7.1 We do not sell personal data

We do not sell your personal data.

7.2 Sharing of Google data

curlyCue does not share your Google Sheets contents with third parties for advertising or marketing. The licensing backend does not receive Google OAuth tokens, Google Sheets contents, Google Drive metadata, or Google API responses. Those data flows occur between the desktop application and Google APIs as described in Section 8. The licensing backend processes licensing and billing information separately.

The app necessarily communicates with Google APIs and QLab (locally) to provide the Service. If you contact support, you may choose to share logs or screenshots that could include identifiers (such as spreadsheet IDs).

7.3 Service providers

We may rely on service providers for limited functions (for example, web hosting for curlycue.app and licensing infrastructure). Those providers may process limited data as needed to deliver their services.

Depending on your use of the Service, our service providers may include:

• Cloudflare (website hosting and licensing backend infrastructure, including Workers, D1, Queues, request processing, and associated request metadata).
• Paddle (billing provider / Merchant of Record; provides us purchase/subscription events via webhooks).
• Resend (transactional delivery of license emails, which may include the recipient email address, license key, license type, and email content).

8. Google API data access and use (Scopes)

curlyCue uses Google OAuth 2.0. When you choose a spreadsheet, you can review the requested permission on the Google consent screen. With your consent, curlyCue requests one scope:

• Per-file Google Drive access: https://www.googleapis.com/auth/drive.file

curlyCue does not request the Google Sheets account-wide scope, Drive metadata scope, or separate Google identity, email, or profile scopes.

8.1 How curlyCue uses Google Picker and per-file access

Google Picker opens in your default browser and lets you browse files using the Google account shown there. Picker returns the file ID of the one Google Sheet you explicitly select. curlyCue then uses the Google Sheets API to retrieve the selected spreadsheet’s title and tab metadata and to perform the synchronization actions described below. curlyCue does not list metadata for the rest of your Drive.

curlyCue does not:

• create, delete, or move files in your Google Drive;
• change sharing permissions on Drive files; or
• read or modify files that have not been explicitly selected through Google Picker or previously granted to curlyCue.

8.2 How curlyCue uses Google Sheets (read/write)

The per-file scope allows curlyCue to use the Google Sheets API to read and write data in a spreadsheet you explicitly select through Google Picker and to continue using a previously selected spreadsheet while its grant remains valid.

curlyCue may:

• read cue-related cell values (for example cue numbers, labels, notes, and other columns you map);
• retrieve the selected spreadsheet’s title and tab metadata;
• write updated cue information back to that spreadsheet when you choose to Push/Update; and
• insert or update rows and cell values as part of synchronization, depending on your chosen workflow.

8.3 Google account information

curlyCue does not request separate Google identity, email, or profile scopes. Google Picker displays the account used for file selection in your default browser. To use a different account, use Disconnect Google in curlyCue and choose a spreadsheet again through Picker.

9. Google API Services User Data Policy (Limited Use)

curlyCue’s use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

In practice, this means (among other things):

• We use Google data only to provide user-facing features in curlyCue.
• We do not use Google data for serving advertisements.
• We do not use Google data to develop, improve, or train generalized AI and/or machine learning models.
• We do not allow humans to review Google user data unless:
  • you explicitly share it with us for support, or
  • it is required for security purposes (for example abuse investigation), or
  • it is required to comply with applicable law.

10. Storage, security, and where data lives

10.1 OAuth tokens and credentials

curlyCue stores OAuth access and refresh tokens locally in the macOS Keychain using system keychain facilities (via the system keyring). Google OAuth credentials do not use a file-based fallback. Tokens are stored on your device and are not intentionally transmitted to our servers.

10.2 Spreadsheet contents

Spreadsheet contents are processed on your device to display and synchronize cues. To reduce repeated API requests, curlyCue temporarily caches spreadsheet rows and headers in process memory for approximately 10 seconds and tab metadata in process memory for up to approximately five minutes. These memory caches are not written to disk and are discarded when the app exits. curlyCue does not upload spreadsheet contents to a remote server as part of normal operation.

10.3 Backups, exports, and logs

Project settings are normally stored under ~/Documents/curlyCue/{Project Name}/, and the name of the last-opened project is stored under ~/Documents/curlyCue/. If a legacy ~/Documents/CueBaby/ folder exists and the preferred curlyCue folder does not, the app may continue using that legacy folder. If you enable backups or export CSV files, those files are created locally in the applicable project folder on your device.

For the bundled application, logs are stored under ~/Library/Logs/curlyCue/ and rotated locally. Development runs may write logs in the directory from which the app was launched. Logs remain on your device unless you choose to share them with support. Logs may include operational identifiers such as spreadsheet IDs, worksheet names, local file paths, error messages, and limited cue identifiers when diagnostic logging is enabled. Review logs before sharing them with support.

10.4 Security practices

No software can guarantee absolute security, but we take reasonable measures appropriate to a small desktop application, including:

• relying on macOS Keychain for credential storage,
• limiting requested Google scopes,
• minimizing server-side storage.

10.5 Licensing backend security measures

For licensing data specifically, we use measures appropriate to a small transactional backend, including:

• HTTPS transport (provided by Cloudflare);
• webhook signature verification for billing events (Paddle);
• application-layer authenticated encryption (AES-GCM) for customer-record email addresses, customer names when present, and recoverable license keys. When a complete raw webhook payload is successfully retained, it is also encrypted with AES-GCM; webhook processing may continue with event metadata and a payload hash if raw-payload encryption fails;
• deterministic lookup values (HMAC) for email search without storing plaintext email;
• hashed identifiers (peppered hashing for license key lookup; hashing for install identifiers);
• admin endpoints protected at the network edge by Cloudflare Access. Requests that reach the Worker must also include an Access JWT whose RS256 signature is verified against the configured Access JWKS endpoint; the Worker also checks any present expiration (exp) and not-before (nbf) claims. Issuing, revoking, or revealing a license and changing a subscription grace period are written to the administrative audit table on a best-effort basis;
• application-level rate limiting on sensitive endpoints, including activation, deactivation, resend, and admin operations, primarily based on client IP. The current limiter is maintained in Worker memory on a per-isolate basis and is intended as baseline protection rather than a globally coordinated rate-limit system.

On your Mac, curlyCue stores the license key and install identifier in the macOS Keychain when available. Cached licensing status is also stored in Keychain. If Keychain storage of licensing status is unavailable, curlyCue may use a local license_state.json fallback in the application’s data directory where that location is writable. This fallback does not contain Google OAuth credentials or Google Sheets content.

11. Data retention

Because curlyCue is primarily local, most retention is under your control.

11.1 Google credentials

Google OAuth tokens stored in the macOS Keychain remain until:

• you sign out within the app; and/or
• you revoke access in your Google account settings; and/or
• you remove the curlyCue credential from macOS Keychain.

Uninstalling curlyCue does not necessarily remove Keychain items. After revocation or sign-out, curlyCue cannot use the stored credential to access Google services unless you authorize it again.

11.2 Local configuration, backups, and logs

Local project settings, backups, exports, logs, app state, and any licensing-state fallback file remain on your device until you delete them or use an applicable in-app removal function. Deleting a project removes that project’s local folder. Uninstalling curlyCue does not necessarily remove project files, logs, Keychain items, or other local data stored outside the application bundle.

11.3 Licensing server data (if applicable)

If you have a paid license, we may retain licensing-related data (such as your encrypted email record, license status, activation hashes, and billing linkage identifiers) for as long as needed to provide license validation, customer support, and fraud prevention, and for a reasonable period afterward or as required by law.

The licensing system also retains operational records such as webhook event processing metadata, encrypted copies of raw Paddle webhook payloads where available, and administrative audit logs for security, billing integrity, and troubleshooting purposes. Administrative audit records may include administrator identity, target email address, action details, and source IP address. The current implementation does not define a strict automated deletion schedule; records persist until deleted.

To request deletion of server-side data we control, contact support@curlycue.app. We may need to retain limited records, such as webhook-processing records or administrative security logs, when necessary for fraud prevention, security, dispute resolution, accounting, or legal compliance. Deletion requests are currently handled manually; the licensing API does not provide a self-service deletion endpoint.

11.4 Support email retention

If you email support, we may retain your message and our replies for as long as necessary to address your request, maintain records of support provided, and comply with legal obligations.

1. Your choices and rights

Depending on where you live, you may have rights to access, correct, or delete certain personal data.

12.1 Revoke Google access

You can revoke curlyCue’s access to your Google account at any time here:

• https://myaccount.google.com/permissions

After revocation, curlyCue will not be able to select, read, or update Google Sheets until you authorize it again and choose a spreadsheet through Google Picker.

12.2 Manage local data

You can delete local logs/backups/exports, uninstall the app, and remove curlyCue items from macOS Keychain.

13. Children’s privacy

curlyCue is not intended for children under the age of 13 (or a higher age as required by local law), and we do not knowingly collect personal data from children.

14. International users

curlyCue runs locally on your device. If we operate limited server infrastructure (for example licensing), it may be hosted in the United States or other locations depending on service providers.

15. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date at the top.

16. Contact us

If you have questions about this Privacy Policy or how we handle data, contact:

• support@curlycue.app