Cue Studio

Privacy

No account, subscription, advertising or analytics. This page explains what stays on your device and what the public live-sync service processes.

Last updated: 20 October 2026. Applies to teleprompter.special.lu.

Who operates this service

Live Production S.à r.l.-S, 56a Rue de Kahler, L-8378 Kleinbettingen, Luxembourg, is responsible for the public service. For privacy enquiries, contact hello@special.lu or +352 661 990 450. Company registration details are in the legal notice.

Scripts, settings and offline storage

The editor saves your scripts, formatting, settings, launchpad keys and shortcuts, position, rundown, script history, deleted-script recovery and take notes in this browser on this device. Browser storage also holds downloaded speech models and caches app assets for offline use. This storage supports the functions you use; Cue Studio does not set advertising or analytics cookies.

These local records remain until you remove them or clear this site's browser data. Deleting a script moves it into recovery, so it can still be restored. Export a backup before clearing browser data. Exports, transcripts and recordings you download remain under your control.

Public live sync uses the server. While the operator app is open, it automatically connects to a live room and sends the current script, display settings, position, active talent cues and control messages to our relay, including before another device joins. Your saved script library and local history are not uploaded as a cloud library.

Talent displays and phone control

The public relay runs on Cloudflare and keeps the current room state and room credentials in memory, without a script database or persistent room storage. Connected talent displays receive that state; controller links can also operate the room. A room expires within approximately 30 minutes after all connected devices leave. A platform restart or replacement of the relay instance can remove a room sooner, including an active room. If that happens, your local script remains on your device, but you may need a fresh room and new links for the other devices. Closing one tab does not remove a room while other devices remain connected.

Windows in the same browser profile also exchange authenticated updates directly on your computer. This helps an already connected display keep working during an internet or relay interruption; it does not turn off the normal public relay connection. A fresh room may still be needed for devices on other computers after relay state is lost.

Keep room links private: anyone holding a talent link can view its script, and anyone holding a controller link can control it. Credentials are in the link fragment rather than ordinary HTTP requests, but can appear in browser history, screenshots or copied links. Internet connections use HTTPS/WSS; the relay can read the shared script, so this is not end-to-end encrypted.

Project folder names and script membership are saved on the operator device and included in workspace backups. Library folders are not sent to talent displays or added to single-script exports.

Editor notes and take logs

Editor notes store project details, script titles, talent names, take ratings, clip references and custom fields on each device that opens the project. Prompting runs are added to the operator’s log when prompting pauses. Your workspace backup and project exports can include this information. No microphone or playback controls are opened by an editor-notes link.

Choosing Share notes or opening a separate notes tab enables live sharing for this workspace. Shared notes are sent to the same temporary Cloudflare relay described above; sharing reconnects when you reopen the operator workspace. Notes links grant view and edit access to that project’s log, but do not grant talent-script or playback access. Keep these links private. The relay can read shared notes; this is not end-to-end encrypted.

After a device has loaded the project and offline app assets, it can edit its local copy without internet. Edits merge when the devices reconnect to the live room; editing different fields preserves both changes, while competing edits to the same field converge to one value. If a room expires, the operator must send a new link. Clearing one device’s browser storage does not delete copies held by other devices. Deleted take records retain a deletion marker and fields for undo and conflict recovery. Exported project files and backups can therefore retain deleted entries. CSV exports omit deleted entries. To remove all copies, each holder must clear the project’s browser data and delete its exports.

Optional AI connections (MCP)

AI access is off until the operator approves a browser authorization request or creates a connection in Connect devices → AI models · MCP. Each connection has selected permissions, an expiry and a separate private token. It can allow your chosen AI client to read scripts, edit them, control prompting, change display settings, or read and edit production notes. Production-note permissions are separate and off by default. Only enable access for a client and provider you trust.

Requests and their results pass through the temporary relay to your open operator tab. The relay holds connection permissions, outstanding requests and a bounded short-lived result history in memory; it does not create a permanent script library. Your AI client and its provider can receive any data covered by the permissions you grant and may retain it under their own policies. Cue Studio does not choose or connect an AI provider for you. Revoking a connection prevents further requests; it cannot delete data already received by that client.

You can revoke one or all connections from the same panel. Connections also end when they expire, the operator tab reloads or loses its relay connection, or the relay restarts. Tokens are not included in workspace backups or display links. Keep them out of chats, screenshots and shared configuration files. MCP cannot grant microphone permission or start microphone capture. Local editions can use a local MCP endpoint while the operator and relay remain connected.

Browser authorization uses OAuth. To remember client configuration across public relay restarts, Cloudflare Durable Object storage holds up to 512 client registrations: the application name, callback URLs, authentication method, and a one-way hash of a generated client secret where needed. Unapproved registrations expire after one hour and can be removed earlier to admit new clients, except while an authorization request is active. After operator approval, registrations expire after 30 days without valid use and are removed during registry cleanup. This registry contains no scripts, room credentials, access tokens or personal account profile. Approval requests last up to ten minutes, and released single-use authorization codes last at most one minute. Terminal request status may remain in memory for up to another ten minutes to show completion or expiry. The offline app does not cache these records. The authorization page does not open your operator workspace or microphone. The local Node edition keeps registrations in memory.

Microphone, speech following and rehearsal

Selecting Voice tracking or Sound gated starts listening, subject to microphone permission. You can also retry from the microphone indicator beside Talent view. Page loads, restored settings and remote mode changes do not open your microphone. Pausing a take keeps listening on; use the indicator or choose another scroll mode to stop listening. Recording also requires an explicit action and permission. You can stop recording or revoke microphone permission in your browser. Removing permission does not delete downloaded recordings.

Hosting, security and recipients

Cloudflare, Inc. hosts the public application and live-sync relay and provides content delivery and security. Its infrastructure operates globally; we do not promise that public room processing stays in Germany or another specific country. Cloudflare processes connection metadata such as IP addresses, requested resources and request times to deliver and protect the service. We do not enable visitor analytics, advertising pixels, third-party fonts or social embeds. Application observability and request logging are disabled for this deployment. The application does not deliberately log scripts, audio or room credentials. This does not disable Cloudflare's platform security records.

Cloudflare operates internationally, including in the United States. Its privacy policy describes its EU–US Data Privacy Framework reliance, standard contractual clause safeguards and retention criteria. Provider security records follow those policies rather than the live-room expiry. For optional model downloads, see Hugging Face's privacy policy. These links do not contact those providers until you open them.

Purposes and choices

We process the active room state based on our legitimate interest in providing the free teleprompter and device-sync functions you choose to use (Article 6(1)(f) GDPR). Connection metadata and temporary abuse-prevention records support our legitimate interest in keeping that service secure and available. Cue Studio does not use your scripts or audio to train AI models, profile you or make automated decisions about you.

No account or identifying profile is required. Public live sync needs the current script and room connection; for scripts you do not want sent to the hosted relay, use a downloaded local edition with same-computer sync. Optional speech-provider features can be left off. Browser storage restrictions may prevent saved work or offline speech from functioning.

Access, deletion and questions

Clear this site's browser data to remove local scripts, history and app caches; use Settings & tools → Speech setup → Remove downloaded models to remove cached speech models. Close all devices connected to a room and its server state will expire as described above.

You can ask us for access, correction, deletion, restriction, portability or object to processing where applicable by emailing hello@special.lu. We cannot read or delete data that exists only on your device. Do not send controller credentials or confidential scripts in an email; describe the issue first. You may also lodge a complaint with the CNPD, Luxembourg's data-protection authority.