Is Cue safe to install?

Signed installers for Mac and Windows

Both installers are signed by Sophon LLC, the company behind Cue. Your operating system checks the signature when you open the installer, so a warning that the developer cannot be verified means the file is not the one Cue published.

The version and build shown here follow the current stable release listed on the download section. If the file you have shows a different publisher, do not install it; return to heycue.io and download again.

Confirm you are on the official Cue site

Cue is developed by Sophon LLC. Its official website is https://heycue.io. Use these checks when you arrive from search, a shared link or a download recommendation.

1. Check the website: look for heycue.io in your browser's address bar. Compare the full domain rather than relying on a page title, product name or logo.
2. Start downloads here: open the official download section and choose the installer for your computer. Follow the download links published there; the installer itself may be delivered from a separate file host.
3. Find support here: open the official Contact page on this domain for the current support and privacy email.

The Privacy Policy and Terms of Service identify Sophon LLC and describe the service. If you are unsure about a link, return to this site directly before downloading or sharing account information. The About page keeps the same checks.

What Cue keeps locally, syncs and sends

This is a summary of the Privacy Policy, which remains the governing text.

• Local history. Raw dictation and activity history is stored in ~/.cue/history/ on your computer and is not included in Cue account sync. Cue may sync aggregate counts, but not these raw entries. Screenshots and any provider API keys you add are also not part of account sync.
• Account sync when you sign in. Thread indexes and messages, preferences, settings, skills, domains, user memory and tool notes, and aggregate activity statistics are synced through Cue so it can restore them across devices.
• Request-time sending. To carry out a request, Cue may send voice audio for speech-to-text or meeting transcription, a screenshot for a screen-aware task, and selected text, clipboard content, prompts and relevant thread context to the AI or speech provider handling that request. Cue does not use this content to train its own models. Provider-side processing and retention depend on the provider, plan and terms linked in the Privacy Policy.
• Analytics you can turn off. Cue uses PostHog (US Cloud) and Sentry for product analytics and crash reporting. Product analytics is designed not to include transcripts, screenshots, selected text or dictated text. You can disable analytics in Settings → Privacy.

Review before you act

Cue can draft text and complete desktop actions that you review. Safe use depends on that review step. The same boundary applies to every workflow Cue documents.

• Do not use Cue as a substitute for professional legal, medical, financial or other expert judgment.
• Do not rely on Cue output without review when a mistake could cause harm, data loss or an irreversible action.
• If a task does not need desktop context or action, a dedicated dictation tool or browser chat may be a simpler choice.
• When you hand a brief to an external coding agent, that agent keeps its own sign-in, permissions, models and billing. Check what it changed before you accept it. See where Cue works for the conditions on each surface.

Cue does not document a public API, SDK, CLI or MCP server. If you receive a tool, script or extension that claims to be an official Cue integration, treat it as unverified and contact Cue.

Is Cue safe to install FAQ