Privacy Policy

When you register, we collect:

• Email address: for account verification, password recovery, and policy updates
• Username: your display identity on the platform (max 32 characters, alphanumeric)
• Password: stored as a bcrypt salted hash, never in plaintext
• Date of birth: to verify you are at least 13 years old (COPPA compliance)
• Referral code: optional, to attribute a referral and apply eligible rewards

You may optionally provide:

• Profile avatar and icon images
• Status message

All profile information is user-provided and visible to other Cloak users.

Ordinary messages composed in Cloak are encrypted on your device before transmission. Our servers store their ciphertext rather than readable message bodies. Direct messages use AES-256-GCM with conversation keys shared using X25519-based HPKE. Server messages use shared server keys and a random IV for each message.

Voice, video, and screen-sharing media are end-to-end encrypted on participating devices using the client platform's media encryption implementation. Call signaling and routing metadata are processed by the service.

End-to-end encryption does not cover all service data. We process account IDs, server and channel membership, permissions, message routing information, timestamps, reactions, and presence to operate the service. The exceptions below also apply.

Cloak has two deliberate upload paths. Private uploads are encrypted on your device with AES-256-GCM before being sent over HTTPS to our file service. File keys are encrypted before storage and shared with the users or servers you authorize. Private uploads are managed through your encrypted vault.

Public uploads are intended for shareable media such as memes, reels, and other content you choose to share publicly. These files are uploaded over HTTPS without end-to-end encryption and served through a public CDN. Anyone with the public link can access the file. Posting that link in an encrypted chat does not make the file private. Use the private upload option for content that needs end-to-end encryption.

Incoming webhooks and server-hosted flow bots produce content that our servers can read and store without end-to-end encryption. Independently hosted bots that participate as encrypted members decrypt their authorized content on the bot operator's infrastructure. Only add bots you trust.

If you use the Discord importer, our import service receives readable Discord history and stages messages and attachments in private object storage. This staging archive is accessible to the service and is not end-to-end encrypted. Your Cloak client encrypts message bodies as it writes them into Cloak history. Import archives expire after 30 days and are removed by a periodic cleanup process, rather than immediately when an import finishes.

Feedback, report notes, and screenshots you choose to submit are readable by our support and moderation team. Submitting them does not give us the keys to your encrypted conversations.

• Authentication tokens: session tokens used to authenticate requests and manage signed-in devices
• Email verification status: timestamp indicating when your email was verified
• Subscription status: your plan tier and payment status (payment details handled by Stripe)

Our services and hosting providers receive your IP address when you connect. We store registration and referral-related IP information to detect referral abuse and related-account activity. Recent IP records used by these checks expire after 30 days. Registration and referral records are stored separately and do not share that automatic 30-day expiry.

We also derive approximate location from your IP address, such as country or region, to select nearby service infrastructure. This does not use device GPS or precise device-location permission. Network and security processing is separate from the application telemetry described below.

If you subscribe to a paid plan, we additionally collect:

• Billing address: street address, city, state, postal code, and country, processed by our service and sent to Stripe, which stores the billing address for your subscription
• Payment history: transaction amounts, payment status (succeeded or failed), and timestamps, stored on our servers for your records
• Stripe customer ID: a unique identifier linking your Cloak account to your Stripe customer record

Card summary details (brand, last 4 digits, and expiration date) are retrieved from Stripe for display in your account settings but are not stored on Cloak's servers.

If you submit feedback or a report, we collect:

• Your user ID and username
• Feedback type and message content
• Optional attachments or screenshots you choose to include
• For reports: the reported user's information and your notes

Google Analytics runs only on our marketing website at cloak.chat, including its website account pages. It does not run in the Cloak desktop app, mobile apps, or the web chat app at app.cloak.chat.

It collects website usage information such as page views, referral sources, and device/browser information. Google Analytics uses cookies and browser/session identifiers to distinguish visits, so we do not describe this data as fully anonymous. See Google's Privacy Policy and Google's explanation of Analytics cookies.

Desktop, web, and mobile clients send separate first-party usage and performance telemetry to Cloak. This is not Google Analytics. Application analytics are enabled by default and can be disabled in the app's privacy settings on each device.

• A randomly generated installation identifier, retained between launches, and a new session identifier for each app session
• Event names and timestamps, such as a feature being used, along with performance values such as startup time, memory usage, and session duration
• Platform and app version, release channel, OS type and version, architecture, locale, and screen dimensions, where available on the platform

These events do not include message bodies, encryption keys, email addresses, or account IDs. Installation and session IDs let us associate events from the same installation or session, so this is pseudonymous data, not fully anonymous data. The telemetry event table does not store IP addresses; the intake endpoint uses IP addresses temporarily for rate limiting. Other IP processing is described above.

The website uses cookies for sign-in sessions and referral attribution as well as Google Analytics. The referral cookie lasts seven days. Applications use local storage for settings, authentication, encryption material, and the installation identifier described above. Browser controls can block or remove website cookies, but blocking sign-in cookies can prevent account pages from working.

Creating a Cloak account does not require your real name, phone number, an imported contact list, or device GPS access. You may still provide identifying information in your profile, billing details, public content, or a support request.

• Direct messages use AES-256-GCM, with the conversation key exchanged using X25519 (Curve25519) public key cryptography
• Server and channel messages use AES-256-GCM with a random initialization vector (IV) generated for each message
• Voice and video use end-to-end media encryption through WebRTC-based call implementations, including browser and native client support

Clients generate and use private encryption keys locally. Local protection depends on the platform: desktop and mobile use their platform storage mechanisms, while the web app uses browser storage. We also store public keys and encrypted recovery backups of identity and conversation-key material on our servers. Those backups are not plaintext copies of your private keys.

Account setup generates a random 32-character recovery secret, separate from your login password. It protects encrypted key backups and can be exported for safekeeping. Cloak stores encrypted recovery material, including an encrypted copy of the secret, but does not receive a plaintext copy of that recovery secret through the backup process.

Keep your recovery secret safe. You can restore encryption keys using it or link a new device from an existing device. If you lose the secret and access to all devices holding your keys, Cloak cannot restore your encrypted history. Resetting your login password does not recover those encryption keys.

Passwords are hashed using bcrypt with an automatically generated salt before storage. We never store passwords in plaintext. Password requirements include a minimum of 10 characters with at least one uppercase letter, one number, and one special character.

Cloak uses several transports: HTTP/3 WebTransport over QUIC/TLS 1.3 where supported, secure WebSockets for other real-time connections including mobile, HTTPS for REST API requests, file uploads, and this website, and WebRTC for calls. Not every connection uses WebTransport or HTTP/3. Message and private-file encryption happens on the client independently of the transport used to carry it.

Processes subscription payments. Our service processes your billing address and sends it to Stripe for storage. Card summary information (brand, last 4 digits, expiration) is retrieved from Stripe to display in your account settings but is not stored on Cloak's servers. Your Stripe customer ID is stored to manage your subscription, and payment amounts and statuses are stored locally for your transaction history.

Privacy policy: https://stripe.com/privacy

Delivers transactional emails including account verification, password recovery, and subscription receipts. Only your email address and the email content are shared.

Privacy policy: https://resend.com/legal/privacy-policy

Cloak uses BugSplat for crash reporting. This is fully opt-in. By default, no crash data is sent. You can control this in your user settings:

• Off (default): no crash data is sent
• On: crash logs, stack traces, app version, and basic OS information are sent to BugSplat

You can change this setting at any time.

Used only on the cloak.chat marketing website, including website account pages. Google Analytics is not used in our desktop or mobile apps or the web chat app at app.cloak.chat. It uses cookies and identifiers as described above.

Privacy policy: https://policies.google.com/privacy

Powers GIF search within the application. Your search queries are sent to Tenor's API. GIF favorites are stored on our servers, not shared with Tenor.

Hosting and network providers, including Cloudflare, process requests and connection metadata to deliver the service. Object-storage and CDN providers store private ciphertext, public uploads, and service-readable import archives according to the paths described above. Call infrastructure processes signaling and routing metadata and relays encrypted media.

You additionally have the right to:

• Request a copy of your personal data
• Object to processing of your data
• Request restriction of processing
• Data portability: receive your data in a machine-readable format
• Withdraw consent at any time
• Lodge a complaint with your local data protection authority

We do not sell or "share" (as defined by the CPRA) your personal information for cross-context behavioral advertising.

We do not collect: protected classifications, biometrics, precise device geolocation, professional/employment info, or education records as required account fields. Approximate IP-derived location is described above.

Your CCPA/CPRA rights:

• Right to know: what data we collect and how we use it (see above)
• Right to delete: request deletion of your data at any time
• Right to opt-out of sale: we do not sell your data, so there is nothing to opt out of
• Right to non-discrimination: we will not treat you differently for exercising your rights

To exercise any of these rights, contact us at admin@cloak.chat.