CueBoss

Privacy Policy

Last updated · Version 2026-10-12

1In brief

  • The CueBoss app works on your computer. Your rekordbox library, your music and your cue points stay there, and we never receive them.
  • The website collects what an account needs: your name, email address and country, and your password in a form we cannot read. If you sign in with Google, Google shares your name and email address with us instead of you choosing a password.
  • We log update checks and downloads with a scrambled form of the IP address, never the address itself. Like most web servers, ours also keeps ordinary access logs, which do hold IP addresses.
  • The CueBoss app signs in with your CueBoss account, in your web browser, so its update checks and downloads are linked to your account.
  • When the website runs into an error, a report of it goes to Sentry, the service we use to find and fix faults. It can include your IP address and, if you are signed in, your account. Your browser can also send Sentry a report, if it blocks something on one of our pages (section 3 says what it holds).
  • The CueBoss app also sends Sentry a report when it runs into an error: what went wrong, and on what kind of computer. Nothing from your library goes into it, and the app has no setting to turn these reports off.
  • No analytics, no advertising, and we never sell your information. The only cookies are the ones the website needs in order to work.

The rest of this policy gives the details.

2Who we are

CueBoss is run by Cueboss LLC, of 175 Greenwich Street, New York, NY 10007 (“we”, “us”). We decide how and why your personal information is used, which makes us its “controller” under the EU and UK General Data Protection Regulation (GDPR). You can reach us at hello@cueboss.co.

This policy covers the cueboss.co website, CueBoss accounts and the emails we send about them, and what the CueBoss app sends us when you sign it in, when it checks for and downloads updates, and when it runs into an error.

3What we collect

When you create an account

  • Your email address, first name, last name and country.
  • Your password, which we store only as a salted one-way hash, made deliberately slow to compute. We cannot read it, and working a password out from the hash is slow and costly: impractical for a long password that is not a common one, though no hash fully protects a password that is easy to guess.
  • That you agreed to the Terms of Service and this policy, when you did, and which version you agreed to.
  • When your account was created, when you last signed in, and whether your email address has been confirmed.
  • A username, which the website generates for your account. You don’t use it to sign in, and error reports can include it.
  • A random identifier, which the app uses to name your account, so that its error reports never need your name or email address.

When you sign in with Google

If you choose to sign in with Google, Google sends us your Google account’s identifier, your name, your email address and whether Google has confirmed it, and a link to your Google profile picture, and we keep these with your account. We ask you for your country and your agreement to the terms ourselves. We never see your Google password, and we don’t keep the access codes Google issues for the sign-in.

When we email you

We send emails about your account: one to confirm your email address when you sign up (sent again if you sign in before confirming it), one to confirm a new address when you change it, and one whenever you ask to reset your password. When your password, your email address or the Google account you sign in with changes, we email your address to say so (the old address, if that is what changed), with the time and the IP address the change was made from. If someone tries to create an account with an address that already has one, we email that address to say so, and to explain how to reset the password. When your account is given access to download CueBoss, we email you to say so. They are sent through Amazon Simple Email Service (SES), which handles your email address and the message in order to deliver it. We don’t send marketing emails. If we ever want to, we will ask you first.

When you use the website

  • When you sign in, our server keeps a session record linked to your account, so that you stay signed in from page to page.
  • When you sign in, sign up, or ask for a password reset or a confirmation email, our server counts the attempts, keyed by your IP address and by a hash of the email address entered, to block password guessing and other abuse. Each count is kept for up to 5 minutes after the last attempt. While you are signed in, changes to your password or email address are counted against your account in the same way, and kept for up to an hour after the last one.
  • Like most web servers, ours records each request in an access log: your IP address, the time, the page asked for, the response, and the browser and page you came from, as your browser reports them. We use these logs to keep the website running, to fix faults and to protect it from abuse.
  • If the website runs into an error while answering you, it sends a report of the error to Sentry, so that we can find and fix the fault. The report includes the page and the time, your IP address, the request your browser sent (its headers, and what you typed into the form, apart from passwords, which are removed before the report is sent), the values our code was working with when the error happened, and, if you are signed in, your account’s identifier, email address and username.
  • If your browser blocks something on one of our pages because our security rules do not allow it, such as something a browser extension tried to add, it sends a report of that to Sentry: the page’s address and the page you came from, what was blocked, your IP address, and the browser you use, as your browser reports it.

When the app checks for updates, or you download CueBoss

Each time the CueBoss app starts, and whenever you choose Check for Updates…, it asks https://cueboss.co/updates/latest.json whether there is a newer version, and it downloads updates from cueboss.co. Downloading CueBoss from the website works the same way. For each of these requests we log:

  • the time, the file asked for, and whether we had it or refused the request;
  • if you, or the app, were signed in, which account made the request;
  • the kind of request, and whether it asked for only part of the file (a resumed download);
  • the user agent, which names the software that made the request: your browser, or the app’s updater and its version;
  • a salted hash of the IP address, made with a secret key kept on our server. It lets us count requests from the same address without storing the address itself, and we never store the address in this log.

Requests you make while signed in to the website, and the update checks and downloads of an app signed in to your account, are linked to your account. The rest are not linked to any account. Because these requests reach the web server like any other, they also appear in the access logs described above.

When you sign in to the app

The CueBoss app asks you to sign in with your CueBoss account. You sign in on cueboss.co, in your web browser, so the app never sees your password, and each time you sign it in, we ask you to allow it. The website then gives the app a sign-in of its own, which the app keeps, with your email address and your account’s random identifier, in your Mac’s keychain or in Windows Credential Manager. Our server keeps only a one-way hash of the sign-in, with the account it belongs to, when it was made and when it expires.

Each time the app starts while you are online, it renews its sign-in with us and asks which account it is signed in to and whether downloads are open to that account. Its update checks and downloads carry its sign-in, so they are linked to your account, as described above.

Sign Out in the app removes its sign-in from that computer, and from our server if you are online. “Sign out of CueBoss on all computers” on your account page removes every one of them from our server, and so does changing, resetting or setting your password; each computer then asks you to sign in again the next time it reaches cueboss.co. A sign-in also stops working after a year in which the app has not reached cueboss.co, and our server deletes it within a day after that. If you delete the app without signing out, its sign-in and your email address stay in your keychain or Credential Manager until you remove them there.

When the app runs into an error

When the CueBoss app runs into an error, it sends a report of the error to Sentry, so that we can find and fix the fault. Every copy of the app does this, and it has no setting to turn it off. A report includes:

  • what went wrong, and where in the program it happened, including the names of any system libraries involved;
  • the time, and which version of CueBoss you were using;
  • the version of macOS or Windows, and the model of your computer and its kind of processor.

A report never includes anything from your rekordbox library: no track titles, artists, playlist names, cue points, file or folder names, or rekordbox settings. Nor does it include your name, your email address, your computer’s name, or the user name you have on it, which appears in the names of your folders. The app checks each report for these and removes them before it leaves your computer. Sentry sees the IP address a report comes from, as any server does, and we have set it not to store it.

If you are signed in to your CueBoss account in the app, a report also includes your account’s identifier, so that we can tell how many people a fault affects and find the reports behind a fault you tell us about. It never includes your name or email address.

Apart from these reports, signing in, and checking for and downloading updates, the app does not contact us at all, and it has no analytics.

When you contact us

If you email us, we keep your message and our reply so that we can help you.

4How we use it, and our legal bases

The GDPR asks us to name a legal basis for each use of your information. These are ours.

What for What we use Legal basis
To create your account, sign you in and keep you signed in, confirm your email address, and let you reset your password Your account details, what Google shares if you use it, your session, account emails Contract: we need it to provide the account you asked for (GDPR article 6(1)(b))
To know which country’s rules apply to your account, and to understand where CueBoss is used Your country Contract, and our legitimate interest in understanding where our users are (article 6(1)(b) and (f))
To keep a record of what you agreed to When you agreed, and to which version Legitimate interests: being able to show which terms apply to your account (article 6(1)(f))
To deliver the app and its updates Update and download requests, and your account if you or the app are signed in Legitimate interests: keeping the copy of CueBoss you installed up to date (article 6(1)(f))
To sign the app in to your account, keep it signed in, and let you sign it out The app’s sign-ins, and your account Contract: we need it to provide the app to your account (article 6(1)(b))
To count how often CueBoss checks for updates and is downloaded, and from roughly how many places The update and download log Legitimate interests: planning CueBoss’s development, using a hash in place of the IP address (article 6(1)(f))
To keep the website secure and working, prevent abuse, and fix faults Access logs, error reports, the update and download log, sessions, attempt counters Legitimate interests: security (article 6(1)(f))
To find and fix faults in the app The app’s error reports Legitimate interests: making the app work reliably for everyone who uses it (article 6(1)(f))
To answer you Your messages to us Legitimate interests: helping you (article 6(1)(f))
To meet legal obligations and enforce our terms Whatever the obligation or the dispute requires Legal obligation, and legitimate interests (article 6(1)(c) and (f))

Where we rely on legitimate interests, you can object, as section 9 explains. We don’t use your information for advertising, we don’t sell it, and we make no decisions about you by automated means that have legal or similarly significant effects.

5Cookies

The website sets only the cookies it needs in order to work: one that keeps you signed in, one that protects its forms, and one that carries a notice from one page to the next. It sets no analytics or advertising cookies. The Cookie Policy lists each one and how long it lasts.

6Who we share it with

  • Amazon Web Services (AWS). Our server, which holds the website, its database and its logs, is a virtual server hosted by AWS in its US West (Oregon) region, us-west-2. Backups of the database are kept, encrypted, in Amazon S3 in the same region. Amazon SES, also part of AWS, sends our account emails. AWS handles this information on our behalf, under its data processing terms.
  • Google, only if you choose to sign in with Google. Google learns that you are signing in to CueBoss, and handles that under its own privacy policy.
  • Sentry (Functional Software, Inc., in the United States), which receives the reports section 3 describes, only when the website or the app runs into an error or your browser blocks something on one of our pages, and handles them on our behalf.
  • Authorities and advisers, when the law requires it, or when it is needed to protect our rights or someone’s safety.
  • A new owner, if CueBoss is sold or merged. This policy would continue to apply to your information.

If we start offering paid plans, we will name the payment provider here before we take any payment.

7International transfers

Our server is in the United States. If you live elsewhere, including in the EU, the UK or Switzerland, your information is transferred to the United States and stored there. For hosting and email we rely on AWS’s data processing terms, which include the European Commission’s standard contractual clauses, and on Amazon’s certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions. Sentry keeps error reports in the United States, and for them we rely on Sentry’s certification under the EU-U.S. Data Privacy Framework (with its UK and Swiss extensions), with the European Commission’s Standard Contractual Clauses in Sentry’s Data Processing Addendum as the fallback. Signing in with Google is between you and Google, under Google’s own terms.

8How long we keep it

  • Your account: for as long as it exists. When you close it, we delete it within 30 days, apart from anything the law requires us to keep for longer.
  • Sessions: a session expires after 2 weeks, and our server deletes its record within a day after that. If you sign in with your password and leave “Keep me signed in” unticked, it ends when you close your browser instead. Signing in with Google, or by confirming your email address, always keeps you signed in for 2 weeks. Signing out ends a session straight away.
  • Attempt counters: up to 5 minutes after the last attempt for those kept by IP address and email address, and up to an hour after the last attempt for those kept against a signed-in account.
  • Error reports, from the website and the app: up to 90 days.
  • The update and download log: 12 months. If you close your account, the entries linked to it are kept for the rest of their 12 months, no longer linked to it.
  • App sign-ins: until you sign the app out while it is online, use “Sign out of CueBoss on all computers”, change, reset or set your password, or your account is suspended or closed, or until a year passes in which that copy of the app has not reached cueboss.co. Our server deletes an expired one within a day. The one-time code your browser passes to the app lasts a minute, and our server deletes one that was never used within a day.
  • The server’s access logs: 30 days.
  • Backups: copies of the website’s database are encrypted and kept for 30 days. Anything deleted from the website, a closed account included, stays in the backups made before it was deleted until those are deleted in turn.
  • Emails with us: for as long as we need them to deal with what you asked.

9Your rights

Under the GDPR, and similar laws in many other places, you have the right to:

  • get a copy of your personal information;
  • have it corrected if it is wrong;
  • have it deleted;
  • have us restrict how we use it;
  • receive it in a machine-readable form, to take elsewhere;
  • object to our using it on the basis of legitimate interests;
  • complain to a data protection authority (section 13 says how). We’d welcome the chance to put things right first.

To use any of these rights, email hello@cueboss.co, ideally from the address on your account. We may need to confirm that the account is yours before we act. We will reply within one month, and it costs you nothing.

You can reset your password at any time from the sign-in page. If you signed in with Google, you can also remove CueBoss’s access from the third-party connections page of your Google account.

10Children

CueBoss is not meant for children. You must be at least 16 years old to create an account. If we learn that an account belongs to someone younger, we will delete it; if you think one does, please tell us at hello@cueboss.co.

11Security

  • Every page of the website is served over an encrypted (HTTPS) connection.
  • Passwords are stored only as salted one-way hashes.
  • The app’s sign-ins are stored on our server only as one-way hashes.
  • The cookie that keeps you signed in is sent only over HTTPS, and scripts on a page cannot read it.
  • The update and download log stores a hash in place of the IP address.
  • Backups of the database are encrypted before they leave our server, and the key that opens them is not kept there.
  • Access to the server and its database is limited to the people who run CueBoss.

No system is perfectly secure. If a breach puts your information at risk, we will tell you, and the authorities, as the law requires.

12Changes to this policy

When we change this policy, the date and version at the top of this page change too. If a change affects you significantly, we will tell you by email or on the website before it takes effect.

13Contact and complaints

For anything about your personal information, contact us:

Cueboss LLC
175 Greenwich Street, New York, NY 10007
hello@cueboss.co

If you’re not happy with our answer, you can complain to the data protection authority where you live or work, or where you think the problem happened. In the UK, that is the Information Commissioner’s Office.