Privacy

This describes what the current code actually does, not aspirational policy.

What stays on your device

Raw audio waits in your browser's local storage (IndexedDB) until it is sent for transcription, and is deleted from your browser once it has been. To be transcribed, each chunk is sent to earcue, held in Cloudflare R2 storage until Azure OpenAI has transcribed it, and then deleted; a chunk whose transcription never succeeds is deleted automatically after 7 days. Audio is never kept after that. The retention window you set (3 days by default) applies only to audio that has not yet been uploaded (for example while offline); that backlog is swept away automatically once it expires.

What is uploaded and stored

Transcribed speech (text, not audio) and screen captions — short descriptions and salient text extracted from your screen — are uploaded to Azure OpenAI for processing and the resulting text is stored in our Postgres database, tied to your account.

Model run records

Each time earcue asks the model for recommendations, builds memories from your imports, or answers you in Ask earcue, it keeps a short record of that run: which model and instruction version ran, how long it took, how many tokens it used, how it ended, and the internal ids of the items and memories it read and produced. The record holds no text from your mail, chats, documents, or memories, and no copy of the model's answer. We use it to find out why a recommendation appeared and whether a change made them better. Records are deleted automatically once they are 30 days old, and immediately when you delete your account.

There is one exception to “no text”. When Ask earcue looks something up for you, the record keeps what it looked up: the search words, a person's name or address, or the dates it checked, up to 200 characters each. These are usually words from your own question, so search text you type into Ask earcue stays in the run record for up to 30 days. The conversation itself is not stored on our servers: it lives in your browser tab until you reload or start a new one. Only the memories it adds, forgets or changes are kept, as memories. When a message of yours leads earcue to remember something, that one message is also kept, word for word, as a note: the memories point back to it, and you can find the whole message again by searching. Messages that change nothing are not kept.

Signals on imported items

earcue asks Azure OpenAI a few fixed questions about each imported email, chat, calendar event, document and page you read: whether it is worth keeping, how much it matters, whether you owe a reply, whether you promised something in it, and whether it is sensitive. The answers are numbers and short labels, stored with the item in our database. They are included in your export, and deleted with the item, its import, or your account. earcue uses the first two to decide what it learns from first: items that matter are read before others, and automated mail such as receipts and newsletters is read last. Nothing is deleted because of these answers. The last answer keeps sensitive items out of what earcue brings up on its own: an item appears in recommendations only once it has been asked about and judged not to reveal your health, money, legal matters or intimate life. When you ask earcue yourself, in Ask earcue or a memory search, it can still show them.

People, projects and ideas

earcue keeps a list of the people you correspond with, and of the projects, ideas, organisations and places your memories are about, so it can tell you what you last discussed with someone or pick up an idea you parked. Each entry holds a name, the addresses it goes by (email addresses, WhatsApp names, Slack ids), and links to the items and memories about it, and the list is built only from your own imports, memories and chats with earcue. It joins two addresses into one person on its own only when they are the same address, never by a name: a WhatsApp contact with the same name as a sender in your mail stays a separate entry until you merge them in the Memory view. If you tell earcue which WhatsApp name is yours, that name is added to your own entry. The list is included in your export, and deleted with your account; removing an import removes its items' links, and forgetting a memory removes the memory's link.

What is still open

From those signals and the list above, earcue keeps a list of what is still open for you: a reply you owe, something you promised, an answer you are waiting for, someone you have not been in touch with for much longer than usual, or a project or idea with nothing new for weeks. Each entry holds only its kind, its status and the internal ids of the item and person or project it is about, no text. It closes on its own when you reply, get in touch or pick the project up again, and expires after a month. Recommendations are chosen from it: accepting one marks its entry done, and dismissing one marks it dismissed for good, so earcue does not raise it again. The list is included in your export and deleted with the item it rests on, its import, or your account.

How you write

So that the replies and messages earcue drafts for you sound like you, it learns how you write from messages you wrote yourself: mail you sent, and your own lines in WhatsApp, LinkedIn, Fiverr and Slack conversations, never the other side's. It uses only messages its signals did not mark as private, and none that it has not checked yet. Up to 60 of them go to Azure OpenAI, which writes a short description of your style: greetings and sign-offs, length, tone, habits and phrases you use, with no names, numbers or facts about your life. earcue keeps that description, shows it in the Memory view under “How you write”, and learns it again about once a week as you write more. When it drafts a message, it also sends a few of your past messages, those to the same person first, with the draft request. Removing an import or disconnecting a source makes earcue learn it again from what is left, or delete it when too little is. It is included in your export and deleted with your account.

Editing and forgetting memories

When you edit a memory, the new wording replaces it everywhere earcue uses it. The old wording is kept out of view as that memory's history and is included in your export; forgetting the memory deletes it.

Ask earcue forgets or changes a memory only when your own message asks it to, never because an email or document it read says so. Before it does, it sends your last three messages in the conversation, and nothing else, to Azure OpenAI with one yes-or-no question: do they ask to forget or change something? Only the answer, a number, is kept in the run record.

When you forget a memory, earcue deletes its text, the links to the mail, chats, or documents it came from, its earlier versions, anything earcue inferred from it, and the note of your own words it came from, if any. So that the same fact is not learned again from a later email or chat, earcue keeps a marker with three things: the kind of memory (for example “person” or “preference”), what it was about in lower case (often a name, such as “marco”), and its embedding. An embedding is a list of numbers the model computes from the text. It does not store the words, but it does roughly encode what the memory said. If you tell earcue that fact again yourself, the marker is removed. Markers are not in your export, because there is no text left in them, and they are deleted immediately when you delete your account.

Screen filtering, and its limits

Screen frames you flag as sensitive, or that match your blocklist words, are dropped before they are ever uploaded. This filter applies to screen captures only. Speech has no equivalent filter — everything you or people near you say while capturing is transcribed and uploaded. Do not use ambient capture around conversations you would not want recorded as text.

Sub-processors

Azure OpenAI (Microsoft) processes audio, screen frames, and text on our behalf to produce transcripts, captions, watch flags, day reviews, and memory embeddings. Polar processes subscription payments; we do not see or store your card details. Neon hosts our Postgres database. Cloudflare runs the app (Workers), carries its connections to the database (Hyperdrive), holds audio chunks until they are transcribed (R2 and Queues), opens the pages Ask earcue reads for you (Browser Run), keeps the app installers you upload for your cloud computer (R2), and delivers the morning briefing email (Email Sending: your address, and the titles and reasons in it). For accounts we have switched to it, Cloudflare Workers AI also answers the fixed questions about imported items described above, in place of Azure OpenAI. E2B runs your cloud computer when one is turned on for your account.

Accounts

You can sign in with Google or with an email and password. Passwords are stored only as a salted hash, never in plaintext. earcue sends one kind of email: a morning briefing on weekdays at 07:00, with the titles and one-line reasons of that day’s recommendations, never drafts or the content of your messages, through Cloudflare Email Sending. It is on by default for company accounts and off for individuals, and you can switch it on or off on your account page. There are no sign-in links.

Your data, your control

From your account page you can export a copy of your data as JSON: your traces, day reviews, imported items, recommendations, the memories earcue has learned and what it has written about you, the services you connected (without their sign-ins) and any action still waiting for your confirmation, the tasks Ask earcue ran on your cloud computer, and the model run records described above. You can also permanently delete your account and all associated data.

Connected accounts

earcue writes nothing back to Gmail, Calendar, or Slack, with one exception: when you press Send on a reply to one of your recommendations, it sends that reply, exactly as you left it, from your Gmail account in the same conversation. Nothing is ever sent without you pressing Send. Google access requests gmail.readonly, gmail.send and calendar.readonly; Slack access requests the user-scoped channels:history, groups:history, im:history, and users:read. OAuth tokens are stored AES-256-GCM encrypted, never in plaintext. Synced emails, events, and messages are deleted automatically after 30 days. Disconnecting a provider from the Sources page deletes that provider's synced items immediately.

Connected services

You can also connect other services that run an MCP server (Linear, Notion, Todoist and many more), picked from the directory at integrations.sh or by address. earcue does not import anything from them. When you ask Ask earcue something, it may call one of the service's tools, which sends that service what earcue is looking up (for example a search term), and it passes the answer to Azure OpenAI to write its reply. What a service returns is not stored; the run record keeps only which tool was called. Each service is run by its own company under its own terms.

Tools that change something in a service (creating, sending, editing, deleting) stay off until you turn on actions for that service. Even then, one runs only when your own message asks for it: earcue first sends your last three messages in the conversation, and nothing else, to Azure OpenAI with one yes-or-no question, as it does before changing a memory. Even then nothing runs until you press Confirm on it: until you answer, for a day at most, earcue keeps which service and tool it would use, the details it would send and a one-line summary. Once you confirm or decline, or the day passes, it is deleted, and what the service answers is shown to you and not stored. Sign-ins and API keys are stored AES-256-GCM encrypted. Disconnecting a service deletes them.

Pages Ask earcue opens

When browsing is turned on for your account and you give Ask earcue a web address, it may open that page in a browser run by Cloudflare (Browser Run) and read its text to answer you. It opens only sites you typed the address of in the conversation, never one taken from an email or a page it read. The site sees a visit from Cloudflare's network, not from you, and earcue sends no sign-in or cookie of yours. The page's text goes to Azure OpenAI with your question and is not stored; the run record keeps only the site's name, how long it took and how much text came back.

Your cloud computer

When a cloud computer is turned on for your account, it is a virtual machine run by E2B that only your account uses. You sign in to your sites on it yourself, from Sources, and what you sign in to stays on that machine: your passwords and cookies never pass through earcue and are not stored in our database. earcue keeps only what it needs to reach the machine, encrypted. When you ask Ask earcue to do something on a site you typed the address of, it reads the page's structure on that machine and sends it to Azure OpenAI to choose each step. The page is not stored. While the task runs, earcue keeps your request, the sites you named, the steps it took (by kind and the name of the element) and what it noted from the pages; it keeps the answer for 14 days, and the run record keeps only the kinds of steps and site names. Anything that sends or submits waits for your confirmation, and earcue never types a password or presses a pay button. “Sign out of everything” in Sources deletes the machine and every sign-in on it, and deleting your account deletes it too.

You can also add your own apps to that computer by uploading their installers in Sources. earcue keeps each installer you upload, with its file name, size and checksum, in Cloudflare R2 storage, so a new computer can install it again; your computer downloads it from earcue over a link that works for 30 minutes. Removing an app uninstalls it and deletes the installer, and deleting your account deletes every installer. Your export lists the apps, not the installers themselves.

Browser extension

The earcue extension for Chrome sends nothing until you connect it to your account, from Sources in earcue. Once connected, it sends earcue your browsing history (each address, its page title, when you last visited it and how many times) from the last 180 days, then what is new every hour, and your bookmarks (address, title, folder and date added) once a week. Tracking parameters are removed from addresses before they are stored.

If you also turn on “Also add pages I read” in the extension, which asks Chrome for access to the sites you visit, it sends the text of a page you keep open and in view for 8 seconds or more, up to 20,000 characters, with how long you read it. It skips pages with a password or payment card field, pages while you have paused it, and sites you have excluded. You can exclude a site from the extension (“Never add this site”, which also deletes what was already added from it) or from earcue's settings, which also suggests a list of email, chat and sign-in sites to exclude.

If you connect Fiverr in Sources, which asks Chrome for access to fiverr.com only, the extension reads your Fiverr account from fiverr.com tabs you have open and are signed in on, at most every 15 minutes: your Fiverr username, Fiverr's counts of your orders by status, your gigs with their status and their views, clicks, orders and cancellation rate, and whether you accept custom orders. It never opens Fiverr on its own and never changes anything on your Fiverr account. Disconnecting Fiverr in Sources stops it and gives back the fiverr.com access.

What the extension sends is stored in our database with your other imports and used the same way: asked the fixed questions above, distilled into memories, and searched when earcue recommends something or you ask it. It is used only to give you earcue's features: it is not sold, not used for advertising or credit decisions, and not read by people, except with your permission or where the law requires it. The use of information received from the extension adheres to the Chrome Web Store User Data Policy, including its Limited Use requirements. Disconnecting the browser in Sources stops it; removing the imports under Added so far, or deleting your account, deletes what it sent.

Contact

Questions about this policy: reach us via the email address you signed up with, or the address on your billing receipt.