The Memberships Thesis

1. The wallet your phone already had

If you own an iPhone, you already use Apple Wallet. Credit cards, boarding passes, the occasional Starbucks gift card the brand issued via Apple's Wallet API. It's a remarkable piece of infrastructure for the cards Apple has a partner relationship with.

Now open your physical wallet. Or your wallet drawer. Or wherever the other cards live. The AAA card. The gym tag. The library card. The Sam's Club card. The professional-org membership your employer paid for. The one-off prepaid Visa from a relative's birthday card. The punch card from the smoothie place near the office.

These don't go in Apple Wallet. They never will. The cards your phone refuses are the ones you actually own.

CardCue Pro started as a wallet for the cards Apple Wallet could have taken if the brand cooperated. Gift cards, prepaid Visa, loyalty stamps, punch cards. The "cooperation gap" cases, they're real cards, you bought them, and Apple's Wallet API was never going to cover them.

During the beta, we widened it. Memberships are the same shape of problem. A AAA card is a barcode plus an ID number plus a renewal date plus a tier. Apple Wallet doesn't take it. Your physical wallet eats one slot for it. We built Cue's membership type to take it, and it ships in the launch version on August 11, 2026, one of the five categories the wallet covers on day one.

2. What makes a membership different from a loyalty card

It's a real distinction. Loyalty cards measure activity. You get a stamp for every coffee, ten stamps for a free coffee. The loyalty card is interesting because the stamp count goes up.

A membership doesn't go up. A AAA card today does the same thing it did a year ago. You hand it to the tow truck driver, they nod, you get the tow. The data on the card barely moves.

What memberships have that loyalty cards don't:

• Renewal dates. AAA renews. Sam's Club renews. Your gym renews. Most loyalty cards expire when the brand burns the program; memberships expire on a calendar.
• Tier structure. Sam's Club Plus vs. Standard. AAA Premier vs. Classic. The tier matters at the door.
• An annual fee. Loyalty is free; membership has a price. When the renewal hits, you decide.
• Identity signal. Your AAA card has your name on it for a reason. The library card establishes that you're you. The gym fob says the gym pre-cleared you for the door. Loyalty programs don't carry identity that way.
• They sit between uses. A gift card you don't redeem in 90 days is a problem. A AAA card you don't pull out for 18 months is normal, that's how memberships work.

We modeled all of this. The membership type stores a member ID, a tier, a member-since date, a renewal date, an annual fee, and an optional photo. Member IDs and barcodes are encrypted before they leave the device, with a key only your devices hold, same path as gift card numbers. PIN never leaves the device, period. Other fields like name and renewal date sync over an encrypted connection with row-level security.

3. The notification you didn't know you wanted

We don't fire a banner when you walk past your AAA card's office. Memberships are deliberate. You go to the auto shop knowing you'll need AAA. You go to Sam's Club knowing you'll show your membership at the door. Buzzing the user when they're already intentional just adds noise.

What we DO fire: renewal warnings.

The membership the user actually forgets about is the one that's about to lapse. Annual dues notices arrive in email; email gets buried. The result is the user finds out they let it lapse when they try to use it (,"Sorry, your AAA expired in March"). That's the moment we wanted to head off.

Cue's membership renewal warnings:

• On a lead time you choose: the same machinery our expiry warnings use, keyed on the renewal date instead of the expiration date. Pick how far ahead reminders start, from 1 week up to 3 months. "Your AAA card renews soon. $60/year."
• Keeps nudging as the date nears: once a membership is inside that window, Cue reminds you again as renewal approaches, with the urgent ones able to break through quiet zones.
• Per-card weekly throttle: no card fires more than one renewal warning per week. Quiet by default, loud when it matters.

The "I let it lapse" path is supported too. Mark a membership as not renewing in the card detail; the warnings stop. The card stays visible in the wallet (some venues honor lapsed memberships at the door, and users keep them around for the historical record). When you decide to renew after all, one tap flips it back.

4. The surface choices

This is the part that took the longest to get right. Memberships appear differently than the other card types because they behave differently:

The thinking: every notification surface in the app exists to solve "you might forget about this card right now." Memberships don't have that problem. The user knows where their AAA card is; they just need it to be on their phone instead of in a shoebox. So the surface treatment is: visible everywhere the user looks for it, silent everywhere the user isn't looking.

5. The privacy posture

The membership type ships with the same privacy contract as the rest of the wallet:

• Member ID encrypts via AES-GCM (the CryptoVault path) before any cloud sync. Anyone reading our cards table sees ciphertext.
• The data encryption key replicates across the user's devices via iCloud Keychain. Apple's iCloud Keychain encryption guarantees the key is never readable to us. We sync the cards table; the card number and barcode are encrypted client-side, so we can't read those, while other fields sync with row-level security.
• PINs never enter the cloud-sync path. They live in iOS Keychain on the user's device only.
• Photos on the membership card (some have them) live on the device. We don't upload them anywhere.
• Location data: the membership type is excluded from Cue's passive-zone soft fence, we don't even compute distance to AAA's office. The library card doesn't need a "you're near it" treatment.

The privacy default is not a setting. It's a consequence of how the membership type is wired through the app. You can't accidentally turn this off because there's no toggle to turn off.

6. The thesis underneath

CardCue Pro began as a wallet for transactional cards, gift cards spend down, loyalty cards earn rewards, punch cards count to free coffee. The launch version widens that to non-transactional cards. The common thread isn't "value flowing through the card." It's "identity living on the card."

A AAA card carries identity. So does your library card. So does your alumni card. So does the punch card with your brand-new "9 of 10 punches" status; that's an identity signal to the smoothie shop too, "this is the customer who's almost earned a free smoothie." The whole wallet is identity.

Apple Wallet is the wallet for the identities Apple has infrastructure for: payment networks, transit systems, boarding passes, hotel keys. Cue is the wallet for the identities your phone doesn't recognize: the small gym, the local library, the regional auto club, the alumni network, the neighborhood coffee shop, the punch card on the back of a business card.

We built CardCue Pro for the long tail of identity. The early builds covered the spendable end of it. The version launching August 11 covers the rest.

7. What we cut

To ship memberships well, we didn't ship some things we wanted to. The honest list:

• Sharing a membership card between family members. A Sam's Club membership covers two cards. A AAA membership often covers a spouse. Shipping a shared membership card requires a real multi-member card model. Parked for v2. (Not to be confused with App Store Family Sharing, which IS live: one Pro subscription covers your Apple Family, and each member keeps their own private wallet.)
• Membership-flavored Apple Wallet passes. This one un-cut itself: the server-side pass signer is deployed, and one-tap Apple Wallet .pkpass export is live at launch for any card with a confirmed barcode, memberships included. What remains parked for v2 is the membership-specific pass face, tier, renewal date, and member-since rendered on the pass itself rather than just the barcode and essentials.
• Auto-renewal sync. "AAA charged your card $60 last week, bumping the renewal date to next year", would require parsing the user's email or a brand integration. Email parsing is a privacy disaster; brand integrations don't scale to the long tail. Punted indefinitely.
• Tier-aware rendering. Sam's Club Plus members get 2% cashback. AAA Premier gets longer tow ranges. Surfacing those perks in the detail view requires a curated brand database. v2.x.

We'd rather ship the membership type cleanly than ship a half-built version with one of those features bolted on.