Privacy Policy

CueForge connects your iPhone to ComfyUI servers that you run. Your images, prompts, and workflows travel directly between your iPhone and your own servers. The app works without an account, and your creative work never passes through our hands. We collect limited, pseudonymous product analytics and diagnostics to understand whether the app works and to fix failures, and you can turn them off. The free custom node that runs on your server reports anonymous operational telemetry, which its operator can turn off.

What stays on your device

• Your list of ComfyUI servers (names, addresses, connection settings).
• App preferences and cached status information.
• Images you save are written to your Photos library only when you ask.

None of this is transmitted to us.

What our push relay processes

Native push notifications and Live Activities require a small relay service, because Apple only delivers them through its own servers (APNs). When you enable either, the relay stores:

• Your device's anonymous APNs push token, and the Live Activity tokens iOS issues for it.
• A random pairing code that links your device to your servers, and when it was created and last used.
• Random identifiers the app generates: one for this installation and one for each server, so a notification opens the right server and a server you muted or removed stops reaching you.
• If you subscribe to CueForge Pro, the subscription's product and expiry date, so the relay can check you are entitled to push.

Passing through the relay, and not kept, is the content of what it delivers:

• For a notification, a short title and body (e.g. "Render complete"), the name you gave the server in the app, and a link back to the result — never the generated image itself.
• For a Live Activity, generation progress, the server's name, and two labels from your own workflow: the title of the node that is running and the workflow's display name, which is what appears on your Lock Screen. Switch Live Activities off for a server in the app and neither is sent.

None of the stored identifiers says anything about you. Removing push pairing from a server stops all delivery for it. Deleting your last paired server deletes the relay pairing; inactive pairings are automatically deleted after 366 days. We keep no logs of notification or Live Activity content.

Local network access

The app asks for local-network permission so it can reach ComfyUI servers on your LAN. Connections go directly from your phone to your servers; no third party is involved.

Purchases

Subscriptions are processed entirely by Apple through the App Store. We never see your payment details.

Analytics in the app

CueForge uses PostHog for product analytics. It records a random installation identifier; app, operating-system, and device-model information; screens visited; feature actions and their outcomes; coarse counts such as the number of configured servers or workflows returned; and subscription state or plan choice. We do not send names, email addresses, advertising identifiers, or use this data to track you across apps or websites. PostHog is set to discard IP addresses, and IP-based geolocation is disabled.

CueForge uses Sentry for crash, hang, handled-error, and sampled performance diagnostics. Reports can include stack traces, app and device state, and a breadcrumb trail made from the same privacy-filtered feature actions described above.

Analytics and diagnostics never intentionally include server names or addresses, credentials, pairing codes, notification contents, prompts, workflow names or files, image names or image contents. Session replay, screenshots, view-hierarchy capture, generic element autocapture, and network-request capture are disabled. PostHog and Sentry process this limited data on our behalf under their respective security and retention controls. We use it only for app analytics, reliability, and support.

Turning it off. In the app, open the ⋯ menu on the server list and switch off Share analytics & diagnostics. Both PostHog and Sentry stop sending from the app and from its share and notification extensions, and stay off until you switch it back on.

The custom node on your server

The free comfyui-mobile-frontend custom node that CueForge connects to can send operational telemetry — whether it started, whether generations finish or fail and how long they take, whether notifications are delivered — so we can see how it runs on real servers. It is on by default. The person who runs the server can turn it off at any time in the node's Preferences or with an environment variable, which stops it immediately and deletes its random install identifier. ComfyUI's log says on every start whether it is on.

When it is on, the node sends a random install identifier; node, ComfyUI and Python versions and the operating system; and counts, durations and outcomes, rounded into ranges. It never sends prompts, workflows or their names, model or image file names, the server's address, anything identifying the people who use the server, or anything about them individually.

It sends these to our push relay, not to an analytics company. The relay checks every field against the same list, passes the result to PostHog, and stores nothing, so PostHog never learns the server's IP address. The node's own documentation, CUEFORGE_PRIVACY.md, lists every field and every other request the node makes.

This website

The pages on cueforge.dev use Google Analytics to measure how many people visit, which pages they read, and which sites they arrive from. Google Analytics sets cookies in your browser and receives your IP address, which it uses to derive an approximate location and then discards; we never see it. We use this only to understand whether the site is reaching anyone, and we do not use it to build advertising profiles.

You can opt out for every site that uses it with Google's browser add-on, or by blocking cookies for this site. Nothing on this site requires analytics to work — the release-list form and every page function normally with it blocked.

This applies to the website only. It is separate from the analytics described above, which are inside the app.

Release-news list

If you join the CueForge release-news list on this site, we store the email address you enter, the date you submitted it, the page you submitted it from, and the two-letter country your request came from. Your IP address is used momentarily to rate-limit the form and is not stored.

The list is held in Cloudflare Workers KV and copied to Resend, the service we will use to send the announcements. Cloudflare and Resend process this data on our behalf as our providers.

We use the list only to send CueForge product progress and launch announcements. We do not sell it, share it for advertising, or use it for anything else. Every message we send will carry a one-click unsubscribe link; you can also ask us to remove you at any time using the contact address below, and we will delete your address from both systems.

Changes and contact

If this policy changes, the new version will be posted here with an updated effective date. Questions? Email contact@cueforge.dev.