Privacy policy

Your shows never leave your computer. Nothing about what you play reaches us unless you send us a report, or turn on usage statistics, which are off until you do and only ever carry totals for each day.

The main things CueMonkey holds about you are who you signed in as, which Macs you signed in on and when, which plan you are on, and if you pay, your invoices and billing details. There is no analytics on this website, no advertising, and nothing that tracks you across other sites. We email you news and offers only if you ask for them, and every one of those emails can be stopped with one click. The app sends us the log of an evening only when you press Send a report, and how much you use it only if you turn on Share usage statistics with CueMonkey. We do not sell your information. Everything we hold, and every company that handles any of it for us, is set out below, and you can close your account yourself in one place.

This policy is published by Groovy Milk LLC, 11101 Resort Road #194, Ellicott City, MD 21042, United States, a limited liability company formed in the State of Maryland, which is responsible for the information described here (in European terms, the controller). It covers the CueMonkey app for Mac, the CueMonkey Remote app for iPad, the websites at cuemonkey.app and cuemonkey.com, your account, and the service behind them.

Who you are. When you sign in with Google, or with Apple once that is connected, they tell us your name, your email address and, if you have one, the address of your profile picture. We never see or hold a password, and we never ask for one. We also keep the language your console speaks, so that what we send you is in it.

Which Macs. Each Mac you sign in on is recorded as a short code, the date it was first seen and last seen, and the dates its licence was issued and runs to. That code is a one way hash, produced on your own Mac, of an identifier macOS gives to the machine. It is not the serial number of your computer, and it cannot be turned back into one. It exists so that a licence works on the machines you use and not on a hundred others. When the app signs in or renews its licence, it also tells us which version of CueMonkey it is and which version of macOS it runs on, and we keep the latest of each against that Mac.

Your plan. Which plan your account is on, whether it is active, paused or blocked, and how many Macs it may hold a licence on, with a record of each change to it: what it became, when, and who made the change. If you rent Pro, each rental: whether it is a day or a week, its first and last day, the time zone those days are counted in, which is your browser's, what it cost, anything refunded or disputed, and how much of the price of owning Pro your rentals have paid off. If you own Pro, when you bought it and what you paid. If Pro was given to you, when it was given, until when, and by whom.

What we change. If we change anything on your account from our side, we keep a record of our own of what it was before and after, who made the change and when, the email address of the account, and the reason if we gave one. We can also keep a short note on an account.

Emails we send you. Emails about your account and what you bought: a welcome letter when you first sign in, a copy of each invoice, a word when your plan changes or a payment is refunded, a reminder the day before a rental you booked ahead starts and a note when one ends, and a notice when something we promise you changes, such as this policy. These are service emails, not marketing, and they come for as long as you have an account. For each email we send we keep which it was, which address it went to and when, and whether it failed, so we can tell whether it arrived.

News and offers, if you ask for them. They are off unless you turn on Send me news and offers on your account page. When it is on, we send a few emails a year: a new version of CueMonkey, a seasonal offer, and, if you have rented Pro and not been back for a month, at most one every ninety days asking whether a show is coming up. We keep whether it is on, when it was last changed and where (the switch on your account page or an unsubscribe link), and each change, as the record that you asked. Every one of these emails has an unsubscribe link at its foot that works with one click and no sign in, and the Unsubscribe button your mail app shows beside it works too. Either one, or the switch, stops them at once. We do not put a tracking pixel or a tracked link in any email, so we do not know whether you opened one or what you clicked.

If you pay. Stripe takes the payment and we never see the card number. Nothing we sell renews, so paying does not keep your card on file to be charged again. In the payment window you give your name, your country and postcode, and if you like a phone number, a company name, a street address, city and state, a tax ID and an address to send invoices to. Those are kept by Stripe, on the record Stripe keeps for you as our customer, so the next invoice can carry them, and we keep the code Stripe knows you by. We keep a copy of each invoice: the name, email and billing address on it, what it was for, what it cost and the tax on it, the brand and last four digits of the card that paid it, and Stripe's reference for the payment. If what you spent on renting comes off the price of owning it, the invoice says how much. If you agree that a rental starts inside the 14 days you could withdraw in, the invoice also says that you agreed, the words you agreed to, and when. If a card is ever saved with Stripe for your account, we hold its brand, last four digits and expiry date, and nothing more of it.

Reports you send. The app keeps a log of each run on your own Mac. If you press Send a report, we receive the log of the run you send it from and of the one before it, or the end of each if it is a long one, the record of the last crash if there has been one, which version of CueMonkey sent it, that it ran on macOS and the kind of processor, and whatever you typed in the box. The log is the app's own record of the evening: the name of the show, each cue's name and the time it went, the sound devices and cameras it used, and any errors, which can name a file on your Mac. Not the files themselves. If you are signed in on that Mac, the report also says which account sent it, so that we can write back to you, and nothing else about your account goes with it. Our database keeps a report for 90 days, and a nightly job deletes it after that. It is also emailed to us, through Resend, and that copy stays in our mailbox for as long as we keep the email.

Usage statistics, if you turn them on. They are off unless you turn them on, in the app's Settings, under This Mac, or by saying yes the one time the app asks, after the first show you play on that Mac. When they are on, the app counts on your Mac, for each day: how many minutes it was open, how many minutes something was playing and the longest stretch of that, how many times GO was pressed, how many cues were fired of each kind (sound, video, picture and camera), how many shows were opened, and whether a standby Mac or the iPad remote was in use that day. Once a day, and when you quit if it can, it sends us those totals with the day they are for, the version of CueMonkey and of macOS, and the licence on that Mac, which tells us which account and which Mac they came from. Never the name of a show, a cue or a file, never a path, never anything you typed, and never a time finer than the day. Turn them off and nothing more is counted or sent, and the totals not yet sent are deleted from your Mac. Then Delete what was shared, beside the setting, deletes every day your account has shared, from every Mac, at once. Our database keeps a day for 18 months, and a nightly job deletes it after that.

When you write to us. What you type into Write to us: your name if you give it, the address to reply to, what it is about and your message, with which account sent it if you were signed in, and the name and version of your browser, so that we can answer a question about the website. It is emailed to our mailbox and not kept anywhere else. An email you send us yourself is kept in our mailbox in the same way.

If you ask for Pro for a school or a charity. What you type into the form: whether it is a school or a charity, the organisation's name, its registration number and website if you give them, your email address, your name if you give it, what it is for, and when you asked. If you were signed in, which account asked. Then our answer, when we gave it, and a note of why if we wrote one. We keep a request and its answer so that when the same school or charity writes again we know what was decided before. Write to us and we will delete it.

The website. Requests to cuemonkey.app are logged in the ordinary way, including the internet address they came from and the browser that made them, by Cloudflare, whose network serves it, and by Lovable, which the site is built with and which hosts it. Those logs are kept briefly and used to keep the site working and secure. We do not run an analytics service on the website and we do not set advertising cookies.

What stays in your browser. When you sign in on this website, the proof that you did is kept by your own browser, in its own storage for this site rather than in a cookie. It goes to nobody but us, and only when your browser asks us something on your behalf. Signing out removes it, and so does closing your account. When you open the payment window, Stripe's own script is loaded from Stripe, and Stripe may set cookies of its own to prevent fraud, under its own policy. Nothing else is kept in your browser.

Your running orders, your audio, your video, your images and your show files. The contents of any folder. Your location. Anything about what you played, when, for how long or how often, or about the other software on your Mac, except what is in a report you chose to send and, if you turned them on, the daily totals in usage statistics, which name no show, cue or file and no time of day.

The Mac app reaches the internet to sign you in and renew your licence, to ask whether there is a newer version of itself and download it, which it installs only when you say so, to send a report when you press Send, to send usage statistics once a day if you turned them on, to show the picture from your Google profile if it has one, which it loads from Google, and to open a page in your own browser when you press a button that says it will. A sign in carries a one time code, the code for this Mac, the version of CueMonkey, the version of macOS and the language it speaks, and a renewal carries the licence the Mac already holds, with the two versions and the language. It does nothing else over the internet at any time, including while a show is running, and nothing it sends carries anything about a show except a report, and that only when you press Send. Usage statistics never wait for a show: they are sent only while nothing is playing. A licence never stops a show. None of this has to reach us for a performance to go on.

On the network in the room, a Mac running CueMonkey makes itself known by its name, so that a standby Mac and the iPad remote can find it. That stays on the local network, and never reaches us.

CueMonkey Remote, the app for iPad, collects nothing and sends nothing: not to us, not to Apple and not to anyone else. It has no account and no sign in, no analytics and no crash reporting.

It talks only to the Mac running CueMonkey that it is paired with, on the local network or over a cable, and that connection is encrypted with TLS. What it sends is GO, Clear, Blackout and the other things you press. The key it was paired with and the list of Macs it knows stay on the iPad, in its keychain and its own settings, and go when you delete the app.

The one thing it asks iPadOS for is Local Network access, so that it can find the Mac in the room. It asks for nothing else: not the camera, not your location, not notifications, and nothing runs in the background when the app is not in front.

The manual, Write to us and this notice open in your browser, not inside the app. In the United States App Store only, See Pro opens cuemonkey.app/upgrade in your browser too. Apple's App Store has its own privacy policy for what Apple does when you download it.

To issue you a licence and to know it is yours. To keep the limit on how many Macs one account may hold a licence on, and to show you that list so you can prune it yourself. To take your payment, work out the tax, send your invoices and keep the records a seller has to keep. To answer you when you write to us, and when a school or a charity asks us for Pro. To find out what went wrong when you send us a report. If you turned on usage statistics, to see how much CueMonkey is used and which versions are in use, so that we know what to fix and build next. To keep CueMonkey and our service secure and to stop it being misused. To tell you something important about the software or your account, which we do rarely. And only if you asked for them, to send you news and offers, never more than a few a year.

If you are in the European Economic Area or the United Kingdom, the law asks us to say on what basis we use your information. Your account, your Macs, your plan, payments and invoices: to carry out our agreement with you, the terms. Invoices and the records of a sale: because tax law requires us to keep them. Reports, messages and requests you send us, the record of what we change on an account, and the website's logs: our legitimate interest in answering you, fixing CueMonkey, explaining our decisions and keeping the service secure, which we have weighed against your interests. Usage statistics: your consent, which you give by turning them on and withdraw by turning them off. News and offers by email: your consent, which you give with the switch on your account page and withdraw with the switch or the unsubscribe link in any of them. Where the law asks for your consent for something, we ask for it first, and you can withdraw it.

We do not sell your information, we do not share it for advertising, and we do not use it to build a profile of you or to make automated decisions about you.

These companies handle information for us, each only for what it does for us and under its own terms with us.

Supabase hosts the database, the sign in, and the small functions that issue licences, answer your account page and take reports and usage statistics, on servers in the United States.

Google signs you in, because you chose it. Its own privacy policy covers what it does with that. Google also runs our mailbox, so an email you send us, a message from Write to us, and every report, is kept there. Apple will sign you in the same way, once signing in with Apple is connected, and publishes the iPad remote through its App Store. If you pay with Apple Pay or Google Pay, that wallet hands Stripe your card.

Stripe takes payments, works out the tax, and keeps the billing details you give in the payment window. The row you type a card into is Stripe's own, inside a frame Stripe serves, so the number goes to Stripe and never to us. Stripe keeps its own record of every payment under its own policy.

Resend sends the emails we send you, news and offers included, and carries every report and every message from Write to us, every word of it, to our mailbox. Its own privacy policy covers what it keeps.

Cloudflare serves this website, including the file the app can read to find out whether there is a newer version. Lovable, which this website is built with, hosts it. GitHub serves the installer and the updates, and is the first place the app asks whether there is a newer version, so it sees the internet address of a Mac that asks.

Nobody else, except where we are required by law to disclose something, where it is necessary to protect our rights or somebody's safety, or to whoever takes over the business if it is ever sold, who would then be bound by this policy.

On servers in the United States, where we are. If you use CueMonkey from outside the United States, what is described above is handled there. Where the law of the European Economic Area, the United Kingdom or Switzerland requires it, information sent to the United States is protected by the safeguards those laws provide, such as the European Commission's standard contractual clauses in our agreements with the companies above, or their certification under the EU-US Data Privacy Framework.

Your account, its list of Macs, the record of your plan, your rentals and what you bought, the record of emails we sent you, whether you asked for news and the record of each time that changed, and any card details copied from Stripe are kept while your account exists. Close your account and they go with it, immediately and permanently. A Mac you remove from the list is removed immediately.

Invoices are kept after the account is closed, because a seller has to keep them, for as long as tax law requires, which is at least seven years. The record Stripe keeps for you as our customer, with the billing details on it, is kept with them for the same reason. If we ever change something on your account from our side, our record of what we changed, with the address the account had, is kept after it is closed too, so that a decision we made can be explained later.

Our database keeps a report for 90 days, and a nightly job deletes it after that. The copy emailed to us stays in our mailbox for as long as we keep the email.

Usage statistics are kept for 18 months from the day they are about, and a nightly job deletes them after that. Delete what was shared, in the app's Settings, deletes them sooner, and closing your account deletes them at once.

Messages from Write to us and emails you send us stay in our mailbox for as long as we keep the email. A request from a school or a charity, and our answer to it, is kept until you ask us to delete it.

One time sign in codes stop working after five minutes, and are deleted when a new one is made a day or more after that. Website request logs are kept briefly by the services that serve the site.

Closing your account is a button, not a request you have to make to us.

It is at the bottom of your account page. Nothing we sell renews, so there is nothing to cancel first. It deletes the sign in, the account, the list of Macs, the record of your plan and your purchases, any usage statistics you shared, the record of emails we sent you, the record of whether you asked for news, and the card details we copied from Stripe. What stays is set out above: invoices and the billing record at Stripe, our record of anything we changed on your account, any report you sent, which no longer says which account sent it and is deleted on its day, and any request for Pro for a school or a charity, which we delete when you ask.

On that same page you can also see your name and email address, your plan and what has happened to it, your Macs and your invoices, remove any Mac from the list, and turn news and offers on or off. If you would rather we did any of this for you, or if you want a copy of everything we hold, to have something corrected, or to have something deleted that the button does not delete, write to us from the address you signed in with and we will do it, usually within a few days and always within the time the law allows. We may ask you to confirm it is you. You may let somebody else ask for you, if they show us you have.

If you live in the United States. Depending on your state, you may have rights to know what we hold, to have it corrected, to have it deleted, to a copy of it, to opt out of its sale, of targeted advertising and of profiling, and not to be treated differently for asking. That includes residents of California, Maryland, Virginia, Colorado, Connecticut, Utah, Texas, Oregon and the other states with similar laws. Some of those laws apply only to businesses larger than we are; we give everybody these rights anyway. If we turn down a request, you can ask us to look at it again by replying to our answer, and if you are still not satisfied, you can complain to your state's attorney general.

If you live in California. In the last twelve months we have collected the kinds of information set out in clause 2: identifiers such as your name, email address and the code for your Macs; the billing details and records of what you bought; internet activity such as the website's logs and, if you turned them on, usage statistics; and what you send us. We collected them from you, from your Mac and from Google or Apple when you sign in, for the purposes in clause 5, and we disclosed them only to the companies in clause 6, for those purposes. We do not sell or share personal information, as those words are used in California's law, and we do not use or disclose sensitive personal information for anything but providing CueMonkey.

If you live in the European Economic Area, the United Kingdom or Switzerland. You have rights to see what we hold, to have it corrected or deleted, to restrict or object to how we use it, to have a copy of it in a form you can take elsewhere, and to withdraw consent you have given. You can also complain to the data protection authority where you live, though we would like the chance to put it right first.

Do Not Track and Global Privacy Control. We do not track you across other sites and we do not sell or share personal information for advertising, so there is nothing for those signals to turn off. If your browser sends one, we treat it as a request to opt out, and nothing changes, because we already do not do what it asks us not to.

CueMonkey is not directed at children under 13, and we do not knowingly collect information from them. You must be at least 13 to make an account. If you believe a child under 13 has made an account, write to us and we will delete it. We do not sell the information of anybody, of any age, or use it for targeted advertising.

Everything travels over an encrypted connection. The database refuses, by default, to show any row to anybody, and the few rules that allow anything only ever let an account see and delete its own rows. Licences are signed, and the app checks that signature on your own machine with a key that can only verify and never issue. Only a few named people at Groovy Milk can see the back office, and everything they change there is recorded.

No system is perfectly secure, and we do not claim otherwise. If something goes wrong that affects you, we will tell you, as the law requires.

We may change this policy. When we do, we post the new policy here with a new "Last updated" date at the top of this page, and if the change is significant we email the people who have an account about it. We will not use what we already hold in a way that is materially different from what this policy said when we collected it without asking you first.

Groovy Milk LLC, 11101 Resort Road #194, Ellicott City, MD 21042, United States. hello@groovymilk.io. Write about anything in this policy, or to use any of the rights above, and a person will answer.