Why a DMG looked attractive
Direct Mac distribution gives a developer control over release timing, update delivery and the relationship with customers. A signed and notarised DMG can be a perfectly legitimate way to ship a Mac app.
It also asks the customer to download a disk image, move the app into Applications, trust the developer's update path and understand macOS security prompts. Paid features then need a separate checkout, licence or account system. That was more installation and privacy infrastructure than Cueable needed for its first public release.
What the App Store changes
The App Store makes installation and updates familiar. Apple reviews the submitted app, signs the distributed build, presents its privacy information and gives users one place to reinstall it. The iPhone, iPad and Mac versions can be configured under one universal purchase where Apple's requirements allow it.
The intended result is simple. Buy Cueable+ Monthly on iPhone and the same entitlement can work on Mac. Buy Lifetime on Mac and restore it on iPhone. This normally depends on using the same Apple Account for App Store purchases. iCloud syncing is separate and is not what transfers ownership.
Why the sandbox matters
App Sandbox limits what an app can access by default. Cueable must declare the capabilities it needs and request user permission for protected resources. That creates a stronger boundary around files, devices and personal information than an unrestricted desktop process.
Sandboxing is not a magic safety certificate. A badly designed sandboxed app can still collect unnecessary data through allowed network access, and legitimate features may need carefully scoped capabilities. The benefit is that access is constrained and reviewable. Cueable should request only what a feature requires, explain why, and continue to offer useful local behaviour when an optional permission is declined.
- Study data stays inside Cueable's container unless you export or enable syncing
- Microphone and speech access are requested only for relevant features
- Calendar or notification access is tied to features that use it
- Imported files are selected through system-controlled access
- Optional CloudKit sync uses the user's private iCloud database
More private Cueable+ payments
Cueable+ will use StoreKit instead of a website card form. Apple presents the current storefront price, authenticates the customer and handles billing. Cueable and RevenueCat do not receive the customer's card number or Apple Account password.
RevenueCat validates the signed transaction and activates the cueable_plus entitlement. It receives limited purchase and technical information, which Cueable discloses, but it does not need study notes or flashcard history. This is a cleaner separation: StoreKit handles payment, RevenueCat handles access state, and CloudKit handles optional study-data syncing.
- No Stripe checkout
- No Cueable billing email
- No licence key to copy between Macs
- No custom device-transfer limit
- Restore Purchases uses Apple purchase history
What customers gain
The biggest improvement is not a new badge on the website. It is fewer unusual steps. Installation comes from the App Store. Updates come through Apple. Cueable+ prices are shown in the customer's currency. Purchase authentication uses a familiar Apple interface. Restoring access uses the same system as other App Store purchases.
Moving to the App Store also supports Cueable's expansion beyond Mac. The interface will still be designed for each Apple device rather than treated as one stretched layout, while purchase ownership can remain consistent across compatible versions.
What this move does not guarantee
App Store review does not guarantee that an app is perfect, that data can never be lost or that every feature will be available on every device. Sandboxing can also require redesigning features that were straightforward in a direct Mac build.
Cueable is still unreleased, so the App Store listing, compatibility details, prices, trials and release date are not final. The website will not pretend that a purchase is available before the actual StoreKit products and app have been reviewed and tested.
The release standard
Before launch, Cueable needs to pass purchase, restoration, cancellation, expiration, offline entitlement and CloudKit sync testing across devices. The App Store privacy disclosure must match the final SDK behaviour, RevenueCat's privacy manifest must be included correctly, and the paywall must show clear renewal terms plus Privacy Policy and Terms of Use links.
That takes longer than uploading a DMG. It also produces a release path that is easier to understand, more private for Cueable+ payments and better suited to the iPhone, iPad and Mac future Cueable is building toward.