Security

SyntaxCue has no backend. There is no SyntaxCue server anywhere in the audio path — audio is captured and transcribed locally on your machine and never leaves it. The app makes exactly three kinds of network connection, all listed in full below: to your own LLM provider (with your key), to LemonSqueezy to check your license, and to GitHub’s public API to see if a newer version exists. There is no analytics, no telemetry, no crash reporting, and nothing phoning home to any server we operate — because we don’t operate one.

At a glance

Network connections the app makes	Exactly three: your LLM provider (your key), LemonSqueezy license API, GitHub public releases API. Nothing else.
Audio	Captured and transcribed locally (whisper.cpp, on-device), processed in memory, never written to disk, never transmitted.
What leaves your machine	Only the text of a transcribed question (and an optional screenshot), sent directly to your own LLM provider. Never anything audio-shaped.
Where your API key lives	OS-native secure storage — macOS Keychain / Windows Credential Manager — never a plaintext file.
Analytics / telemetry	None. There is no SyntaxCue backend to collect anything.
Code signing — macOS	Signed with an Apple Developer ID and notarized by Apple.
Code signing — Windows	Not yet signed (disclosed below).
Release checksums	SHA-256 published for every release, starting with v0.1.7.
Open source	No — the client source is not public today.

Every network connection this app makes

This is the complete list — not examples. You can confirm it yourself with a network monitor while the app runs.

1. Your own LLM provider. Either api.anthropic.com/v1/messages or api.openai.com/v1/chat/completions, depending on which you choose — connected directly from your machine to the provider, using your own API key. This happens only when you actually submit a question. There is no SyntaxCue server in this path; your request goes to Anthropic or OpenAI and nowhere else.

2. LemonSqueezy’s License API. api.lemonsqueezy.com/v1/licenses/activate, /validate, and /deactivate. This happens when you enter a license key, and then roughly once every 30 days for a silent background revalidation. If you’re offline when that check would run, it’s a no-op — it doesn’t block anything or interrupt you.

3. GitHub’s public releases API. api.github.com/repos/ZetBaur/syntaxcue-releases/releases/latest, once per app launch, to check whether a newer version exists. No account, no auth token — it’s the same public endpoint anyone can curl. If a newer version exists, the app shows a note. It never auto-downloads or auto-installs anything.

That’s all of it. No fourth connection, no analytics beacon, no usage statistics, no crash reporter — there is no server of ours for any of that to go to.

What never leaves your machine

• Your audio. It’s captured and transcribed locally with an on-device model (whisper.cpp), held in memory, never written to disk, and never transmitted anywhere. Nothing audio-shaped ever crosses the network. The only thing that leaves your machine is the text of a transcribed question — and an optional screenshot image if you capture one — sent directly to your own chosen LLM provider.
• Your hint history. The visible hint history in a session resets when you close the app. It is not persisted between sessions by default.
• Your API key. Stored in OS-native secure storage — macOS Keychain or Windows Credential Manager, via the keyring library — never in a plaintext file. Clearing the API key field in the app actually deletes the Keychain/Credential Manager entry, not just hides it from the UI. There’s also a one-click “Remove license from this device” control.

Your settings (provider choice, interview context, hotkeys) and license state are stored as plain local JSON files in the OS’s standard per-app data directory. These are preferences, not secrets, which is why they’re not in the Keychain — but your API key, which is a secret, is.

How to verify your download

Every release on github.com/ZetBaur/syntaxcue-releases (starting with v0.1.7) publishes a SHA-256 checksum of the .dmg/installer in that release’s notes. To confirm the file you downloaded matches what was published:

macOS:

shasum -a 256 /path/to/SyntaxCue.dmg

Windows (PowerShell):

Get-FileHash C:\path\to\SyntaxCue-Setup.exe -Algorithm SHA256

Compare the output against the value posted on the GitHub release page. If they match, the file wasn’t corrupted or swapped in transit.

To be precise about what this proves: it confirms the file you have matches what was published under that release tag. It is not, by itself, proof of what’s inside the app — there’s no reproducible-build setup today that would let you independently verify the binary was built from a specific source. It verifies integrity of the download, not the contents of the build.

What we don’t do (yet)

Stated plainly, because vague reassurance would defeat the point of this page:

• The client source code is not open source. The main development repo is private. There is a separate public repo, but it hosts only the compiled release binaries — not source. So you cannot audit the source today. We’re telling you that directly rather than implying otherwise.
• No independent third-party security audit has been done. We’re not going to imply one exists.
• No bug bounty program exists.
• The Windows build is not yet code-signed. On first launch, Windows SmartScreen may show an “unrecognized app” notice; you get past it with “More info” → “Run anyway.” This is a known, temporary gap, and signing is planned. (The macOS build is signed with an Apple Developer ID and notarized, so it opens with the standard Apple confirmation, not an “unidentified developer” warning.)

SyntaxCue is a solo-developer product, and these are the honest current limits of what you can independently verify. The things you can verify today — every network connection, local-only audio, where your key is stored, and the download checksum — are listed above specifically so you can check them yourself.

How to report a security issue

Found something? Email us directly — the same support address used for all feedback, listed on the Contact page. There’s no public issue tracker or bug bounty (it’s a solo-developer product), but security reports are taken seriously and we’d rather hear from you directly.

Get SyntaxCue

Download it, check every claim on this page yourself, and decide from there.