Privacy Policy

1.1 Account Information

When you create an account, we collect:

1.2 Billing Information

When you subscribe to a paid plan:

• Stripe customer ID and subscription ID are stored to link your account to your subscription
• Payment card details are handled entirely by Stripe — card numbers, CVVs, and billing addresses never touch our servers

1.3 Content You Protect

Cloaked uses a proxy architecture — your article text is never stored in our database. When a visitor loads your page, we fetch the content directly from your CMS at that moment and hold it in a short-lived cache (up to 5 minutes) to serve concurrent requests efficiently. After that window the cached copy is discarded; see Section 7.3 for the derived render caches.

What we do store in our database:

• The title and CMS identifier of each content source you register
• A fingerprint (SHA-256 hash) of the last fetched content body, so we can detect when your content changes

We do not store your content in recoverable form, and we do not read, analyze, or share it.

1.4 Render Analytics

When your protected content is viewed by end users, we collect:

1.5 API Keys

• API keys you create are stored as a bcrypt hash; the full key is shown to you once at creation and cannot be retrieved afterward
• A short identifying prefix (currently the first 16 characters) is stored in plaintext so you can tell keys apart in the dashboard
• The dashboard’s own provisioned API key, which it uses to call the API on your behalf, is stored in a form that allows retrieval rather than as a one-way hash

1.6 Site Configuration

If you integrate Cloaked with a CMS:

• Site base URL is stored in plaintext
• CMS API keys are encrypted at the application layer
• Webhook secrets are randomly generated (nanoid)

3.1 Encryption and Hashing

3.2 Infrastructure Security

• Our application and database run on infrastructure we operate and control directly, not on a third-party application-hosting platform
• Traffic is served through Cloudflare for DNS, CDN and DDoS protection, over encrypted connections
• Backups are encrypted before they leave our infrastructure and stored with Google Cloud Storage (see Section 7.4)

3.3 Access Controls

• JWT-based authentication; sessions expire after a period of inactivity (currently 24 hours) rather than a fixed lifetime
• API rate limiting to prevent abuse (per-endpoint limits with sliding windows)
• API keys are hashed; only the identifying prefix (currently the first 16 characters) is visible in the dashboard
• No shared admin accounts; individual account access only

6.1 What We Use

• JWT session token: A secure, HTTP-only token for authentication. It expires after a period of inactivity (currently 24 hours) rather than a fixed lifetime. This is a functional session cookie, not a tracking mechanism.

6.2 What We Do Not Use

• No advertising cookies
• No analytics cookies
• No third-party tracking pixels
• No cross-site tracking of any kind

Because we only use a functional session token, most cookie-consent requirements do not apply. However, we inform you here for full transparency.

7.1 Account Data

• Account information is retained for as long as your account is active
• Upon account deletion, we remove your account profile and credentials, API keys, site configuration and encrypted content credentials, your monthly render-count records, and subscription and billing references
• Any residual render event records are pseudonymized rows that lose their association with your content when it is deleted, and they are automatically deleted from our live systems within the retention window described in 7.2

7.2 Render Analytics

• Render and interaction events — keyed hashes of IP address and browser user agent, viewport width, and event metadata such as the page URL — are retained for approximately 90 days, then automatically deleted from our live systems
• Monthly render counts reset each billing cycle

7.3 Ephemeral Data

• Fetched article content is held in a cache for up to 5 minutes to serve concurrent render requests, then discarded
• Layout caches — holding the glyph geometry derived from your article, itself a recoverable representation of the text — expire automatically, currently within an hour (longer-lived than the content cache above)
• Other Redis-cached data, such as rate limit counters and token IDs, also expires automatically via TTL and is not retained long-term

7.4 Backups

• Database backups may retain data after it is removed from our live systems: daily snapshots are kept for 30 days and monthly snapshots for 12 months, as part of disaster recovery
• Backups are encrypted before they leave our infrastructure and stored with Google Cloud Storage. The encryption key is never shared with Google, so the backup contents are not readable by them

8.1 All Users

Regardless of your location, you have the right to:

• Access your personal data (available via the dashboard and API)
• Correct inaccurate data (update your profile in the dashboard)
• Delete your account and all associated data (see Section 7.1 for what remains during the retention window)
• Export your account, content-source and usage data in standard formats

8.2 European Economic Area (GDPR)

If you are in the EEA, you additionally have the right to:

• Object to processing based on legitimate interest
• Restrict processing in certain circumstances
• Data portability — receive your data in a structured, machine-readable format
• Withdraw consent for any consent-based processing (note: we rely primarily on contract performance and legitimate interest, not consent)
• Lodge a complaint with your local data protection authority

Lawful Bases for Processing:

• Contract performance: Providing the Service you signed up for (account management, content rendering, billing)
• Legitimate interest: Security measures (rate limiting, keyed IP hashing, abuse prevention) and aggregated analytics. We have assessed that these interests do not override your fundamental rights, particularly because we pseudonymize personal identifiers — replacing them with keyed hashes — and do not track individuals.

Pseudonymization, not anonymization: Because we hold the secret that produces these hashes, they remain pseudonymized personal data under GDPR Art. 4(5) rather than anonymous data, and the rights above apply to them.

Data Transfers: Your data is stored and processed in the United States, both by us and by the service providers listed in Section 5. If you access the Service from outside the United States, your data will be transferred there. We rely on Standard Contractual Clauses (SCCs) and provider-specific data protection agreements to ensure adequate safeguards for these international transfers.

8.3 California Residents (CCPA)

If you are a California resident, you have the right to:

• Know what personal information we collect, use, and disclose
• Delete your personal information
• Opt out of sale — we do not sell personal information, so there is nothing to opt out of
• Non-discrimination — we will not treat you differently for exercising your rights

Categories of Personal Information Collected (per CCPA definitions):

• Identifiers: email address, Stripe customer ID
• Internet activity: keyed-hashed IP addresses, keyed-hashed user agents, render counts
• Commercial information: subscription status, usage counts, billing period

We do not sell personal information. We do not share personal information for cross-context behavioral advertising.