Skip to content

Privacy controls

Cue captures screen content while you work. Privacy pause is the primary control: when it's on, the streaming recorder is stopped, recently captured frames are purged, and a red border overlay tells you Cue is not watching.

Manual pause

Platform Hotkey Tray menu
macOS Cmd + Shift + Space menu bar → "Privacy paused" toggle
Windows Win + Shift + Space tray → "Privacy paused" toggle

The hotkey is fire-and-forget — it just enqueues the request, so it never gets stuck behind a slow IPC call. The state change is visible within a few hundred milliseconds.

Manual pause does not persist across restarts. It's an "in-the-moment" control. Auto-pause reasons re-evaluate from live signals on each launch.

Automatic pause

Cue automatically enters privacy pause when any of these signals fire:

Reason What triggers it
manual The user toggled the hotkey or the tray checkbox.
secure_input The OS reports that secure event input is on (a password field or system auth dialog has focus). On macOS this is the Carbon IsSecureEventInputEnabled latch plus an Accessibility check on the focused element's subrole; on Windows it's UIA IsPasswordPropertyId.
blocked_app The frontmost app is on the configurable block list, or its window title matches one of the configured regex patterns.
browser_url The frontmost browser's active tab matches a configured URL regex (and the browser is in the authorized state — see "Browser authorization" below).
system_transition The system is sleeping or just woke up. A short blackout covers the lock-screen / unlock window before regular signals catch up.

Reasons combine: pause stays on as long as any reason is active.

What happens on pause entry

When Cue enters pause, several things happen in sequence:

  1. The streaming recorder subprocess is killed immediately. Any in-flight chunk is abandoned.
  2. A purge cascade runs — using an inclusive cutoff against the last few seconds of timestamped artifacts:
  3. The current chunk's MCAP and .log files are deleted.
  4. Pruner keyframes inside the lookback window are deleted.
  5. Digest rows in the database with timestamps inside the window are removed and digest.md is rewritten from the newest surviving row.
  6. The red-border overlay is shown on every screen.

The lookback window defaults to 5 seconds — bytes captured more than ~5 seconds before the trigger may survive. Widen it via Preferences → Privacy → "Purge lookback" if needed.

What happens on resume

When all pause reasons clear:

  1. The red-border overlay is hidden.
  2. A fresh streaming recorder session is spawned.
  3. There is a brief gap (~1 second) before recording catches up — visible as a single missing keyframe in the digest timeline.

The red-border overlay

A thin pulsing red border outlines every connected display while pause is on. It's:

  • Click-through. It does not intercept mouse input.
  • Visible on full-screen apps. It joins all Spaces (macOS) or is registered as a top-most non-activating window (Windows).
  • Optional. Disable it in Preferences → Privacy if it's visually noisy. Pause still works without the overlay; you just lose the visual confirmation.

Browser authorization (macOS)

macOS requires explicit Automation permission for Cue to read the URL of the active browser tab. To prevent the "all browsers silently brick" footgun, each supported browser sits in one of three states:

  • authorized — the user approved the macOS Automation prompt. URL-based pause is active for this browser.
  • denied — the user explicitly opted out. With the default fail-closed setting, foregrounding this browser triggers pause outright (Cue can't read the URL, so it errs on the side of caution).
  • unknown — the user hasn't decided yet. Permissive: Cue does not pause just because this browser is in front, but URL filters also don't apply to it.

Toggle a browser's state under Preferences → Privacy → Browsers. "Ask now" re-prompts the OS for the Automation permission.

What is not paused

Privacy pause stops screen capture and the digest pipeline. It does not:

  • Quit Cue. The menu-bar icon stays; the hotkey stays registered.
  • Affect the API key, settings, memory, or past digest history.
  • Stop the OS from logging your input. Pause is an application control — for system-level guarantees use a privacy-focused OS posture (FileVault, hardened keychain).

Known gaps

Some cases are not currently covered. See Troubleshooting for the full list.