Security

There is no SyntaxCue server anywhere in the audio path — audio is captured and transcribed locally on your machine and never leaves it. The app makes five kinds of network connection, all listed in full below: to your own LLM provider (with your key), to LemonSqueezy to check your license, to GitHub’s public API to see if a newer version exists, to our own free-tier hint counter while you’re on the free tier (hashed device ID only), and — once you activate a paid license — to our own activation log (your license key plus a hashed device ID, so we can spot a key shared across many devices). There is no analytics, no telemetry, no crash reporting, and nothing about your interview ever reaches a server we operate.

At a glance

Network connections the app makes	Five: your LLM provider (your key), LemonSqueezy license API, GitHub public releases API, our free-tier hint counter (hashed device ID, free tier only), and our paid-license activation log (license key + hashed device ID, paid tier only). Nothing else.
Audio	Captured and transcribed locally (whisper.cpp, on-device), processed in memory, never written to disk, never transmitted.
What leaves your machine	Only the text of a transcribed question (and an optional screenshot), sent directly to your own LLM provider — plus a hashed device ID to our hint counter, free-tier only. Never anything audio-shaped, never interview content, to us.
Where your API key lives	OS-native secure storage — macOS Keychain / Windows Credential Manager — never a plaintext file.
Analytics / telemetry	None. No product-usage tracking of any kind.
Code signing — macOS	Signed with an Apple Developer ID and notarized by Apple.
Code signing — Windows	Not yet signed (disclosed below).
Release checksums	SHA-256 published for every release, starting with v0.1.7.
Open source	No — the client source is not public today.

Every network connection this app makes

This is the complete list — not examples. You can confirm it yourself with a network monitor while the app runs.

1. Your own LLM provider. Either api.anthropic.com/v1/messages or api.openai.com/v1/chat/completions, depending on which you choose — connected directly from your machine to the provider, using your own API key. This happens only when you actually submit a question. There is no SyntaxCue server in this path; your request goes to Anthropic or OpenAI and nowhere else.

2. LemonSqueezy’s License API. api.lemonsqueezy.com/v1/licenses/activate and /validate. This happens when you enter a license key, and then roughly once every 30 days for a silent background revalidation. If you’re offline when that check would run, it’s a no-op — it doesn’t block anything or interrupt you. The app itself never calls LemonSqueezy’s /deactivate endpoint — freeing up a device slot is self-serve, done from your own LemonSqueezy account portal (linked from the app’s License section), not from inside the app.

3. GitHub’s public releases API. api.github.com/repos/ZetBaur/syntaxcue-releases/releases/latest, once per app launch, to check whether a newer version exists. No account, no auth token — it’s the same public endpoint anyone can curl. If a newer version exists, the app shows a note. It never auto-downloads or auto-installs anything.

4. Our own free-tier hint counter — free tier only. syntaxcue.com/api/trial-hint, a Cloudflare Pages Function we operate. This one is a server of ours, so here’s exactly what it does and doesn’t see. It exists because the original design — a hint counter in a local file — turned out to be trivially defeated by deleting and reinstalling the app, with no technical skill required, which undermines the whole point of a metered free tier. The app now sends a hashed hardware identifier (IOPlatformUUID on macOS, registry MachineGuid on Windows — hashed with SHA-256 before it ever leaves your machine, so the raw ID never reaches us) to check and record your remaining free hints. It receives nothing else — not your name, email, audio, transcribed text, screenshots, or AI answers. This call happens once when a hint is requested (to check you have one left) and once after (to record it used). It stops entirely the moment you activate a license — a paid copy never contacts this endpoint, ever. If this endpoint is unreachable, the app fails closed: it blocks the hint rather than silently allowing one, so an interrupted trial check can’t be used to bypass the limit either.

5. Our own paid-license activation log — paid tier only. syntaxcue.com/api/license-activation, a Cloudflare Pages Function we operate. It exists to catch the one gap self-serve licensing has no technical way to prevent: a person deactivates their license and hands the key to someone else, who activates it on a different device. We don’t build DRM against this (SyntaxCue has none — see below), but we do watch for it. Each time you activate a license, the app sends your license key as-is (it’s proof of a $79 purchase, not a secret the way an API key is) plus a hashed hardware identifier, the same kind used for the free-tier counter. A key seen on an unusually high number of distinct devices gets flagged for manual review — there is no automatic revocation, and reviewing a flag is a human decision made in the LemonSqueezy dashboard, not code. This call happens only on activation, never on ordinary use, and never for the free tier (see connection 4 above for that case instead).

That’s all of it — five connections, no analytics beacon, no usage statistics, no crash reporter, and nothing about your interview reaches any server we operate.

What never leaves your machine

• Your audio. It’s captured and transcribed locally with an on-device model (whisper.cpp), held in memory, never written to disk, and never transmitted anywhere. Nothing audio-shaped ever crosses the network. The only thing that leaves your machine is the text of a transcribed question — and an optional screenshot image if you capture one — sent directly to your own chosen LLM provider.
• Your hint history. The visible hint history in a session resets when you close the app. It is not persisted between sessions by default.
• Your API key. Stored in OS-native secure storage — macOS Keychain or Windows Credential Manager, via the keyring library — never in a plaintext file. Clearing the API key field in the app actually deletes the Keychain/Credential Manager entry, not just hides it from the UI. Freeing up your license’s device slot (e.g. to move to a new machine) is self-serve from your LemonSqueezy account portal, linked directly from the app’s License section.

Your settings (provider choice, interview context, hotkeys) and license state are stored as plain local JSON files in the OS’s standard per-app data directory. These are preferences, not secrets, which is why they’re not in the Keychain — but your API key, which is a secret, is.

How to verify your download

Every release on github.com/ZetBaur/syntaxcue-releases (starting with v0.1.7) publishes a SHA-256 checksum of the .dmg/installer in that release’s notes. To confirm the file you downloaded matches what was published:

macOS:

shasum -a 256 /path/to/SyntaxCue.dmg

Windows (PowerShell):

Get-FileHash C:\path\to\SyntaxCue-Setup.exe -Algorithm SHA256

Compare the output against the value posted on the GitHub release page. If they match, the file wasn’t corrupted or swapped in transit.

To be precise about what this proves: it confirms the file you have matches what was published under that release tag. It is not, by itself, proof of what’s inside the app — there’s no reproducible-build setup today that would let you independently verify the binary was built from a specific source. It verifies integrity of the download, not the contents of the build.

What we don’t do (yet)

Stated plainly, because vague reassurance would defeat the point of this page:

• The client source code is not open source. The main development repo is private. There is a separate public repo, but it hosts only the compiled release binaries — not source. So you cannot audit the source today. We’re telling you that directly rather than implying otherwise.
• No independent third-party security audit has been done. We’re not going to imply one exists.
• No bug bounty program exists.
• The Windows build is not yet code-signed. On first launch, Windows SmartScreen may show an “unrecognized app” notice; you get past it with “More info” → “Run anyway.” This is a known, temporary gap, and signing is planned. (The macOS build is signed with an Apple Developer ID and notarized, so it opens with the standard Apple confirmation, not an “unidentified developer” warning.)

SyntaxCue is a solo-developer product, and these are the honest current limits of what you can independently verify. The things you can verify today — every network connection, local-only audio, where your key is stored, and the download checksum — are listed above specifically so you can check them yourself.

How to report a security issue

Found something? Email us directly — the same support address used for all feedback, listed on the Contact page. There’s no public issue tracker or bug bounty (it’s a solo-developer product), but security reports are taken seriously and we’d rather hear from you directly.

Get SyntaxCue

Download it, check every claim on this page yourself, and decide from there.