Privacy Policy

1.1 Account Information

When you create an account, we collect:

1.2 Billing Information

When you subscribe to a paid plan:

• Stripe customer ID and subscription ID are stored to link your account to your subscription
• Payment card details are handled entirely by Stripe— card numbers, CVVs, and billing addresses never touch our servers

1.3 Content You Protect

When you submit articles for protection:

• Article content is encrypted at rest using AES-256 before being stored in our database
• We store a SHA-256 content hash to detect changes and manage cache invalidation
• We do not read, analyze, or share your content

1.4 Render Analytics

When your protected content is viewed by end users, we collect:

1.5 API Keys

• We store only a bcrypt hash of each API key
• An 8-character prefix is stored in plaintext for identification in the dashboard
• The full API key is shown to you once at creation and cannot be retrieved afterward

1.6 Site Configuration

If you integrate Cloaked with a CMS:

• Site base URL is stored in plaintext
• CMS API keys are encrypted at the application layer
• Webhook secrets are randomly generated (nanoid)

3.1 Encryption and Hashing

3.2 Infrastructure Security

• Database hosted on Neon PostgreSQL with encrypted connections
• Caching via Upstash Redis with token-based authentication
• API hosted on Railway with isolated containers
• Dashboard hosted on Vercel with edge network protection
• Widget assets served via Cloudflare CDN with DDoS protection

3.3 Access Controls

• JWT-based authentication with 30-day session lifetime
• API rate limiting to prevent abuse (per-endpoint limits with sliding windows)
• API keys are hashed; only the 8-character prefix is visible in the dashboard
• No shared admin accounts; individual account access only

6.1 What We Use

• JWT session token: A secure, HTTP-only token for authentication with a 30-day lifetime. This is a functional session cookie, not a tracking mechanism.

6.2 What We Do Not Use

• No advertising cookies
• No analytics cookies
• No third-party tracking pixels
• No cross-site tracking of any kind

Because we only use a functional session token, most cookie-consent requirements do not apply. However, we inform you here for full transparency.

7.1 Account Data

• Account information is retained for as long as your account is active
• Upon account deletion, all associated data is permanently removed, including: account profile and credentials, API keys, articles and encrypted content, render event records, and subscription and billing references

7.2 Render Analytics

• Render event data (hashed IPs, hashed user agents, viewport data) is retained for the duration of your account
• Monthly render counts reset each billing cycle

7.3 Ephemeral Data

• Redis-cached data (rate limit counters, token JTIs, layout caches) expires automatically via TTL and is not retained long-term

7.4 Backups

• Database backups may retain deleted data for up to 30 days as part of disaster recovery
• Backups are encrypted and access-controlled

8.1 All Users

Regardless of your location, you have the right to:

• Access your personal data (available via the dashboard and API)
• Correct inaccurate data (update your profile in the dashboard)
• Delete your account and all associated data
• Export your data (articles and analytics) in standard formats

8.2 European Economic Area (GDPR)

If you are in the EEA, you additionally have the right to:

• Object to processing based on legitimate interest
• Restrict processing in certain circumstances
• Data portability — receive your data in a structured, machine-readable format
• Withdraw consent for any consent-based processing (note: we rely primarily on contract performance and legitimate interest, not consent)
• Lodge a complaint with your local data protection authority

Lawful Bases for Processing:

• Contract performance: Providing the Service you signed up for (account management, content rendering, billing)
• Legitimate interest: Security measures (rate limiting, IP hashing, abuse prevention) and aggregated analytics. We have assessed that these interests do not override your fundamental rights, particularly because we hash personal identifiers and do not track individuals.

Data Transfers: Your data may be processed in the United States by our infrastructure providers. We rely on Standard Contractual Clauses (SCCs) and provider-specific data protection agreements to ensure adequate safeguards for international transfers.

8.3 California Residents (CCPA)

If you are a California resident, you have the right to:

• Know what personal information we collect, use, and disclose
• Delete your personal information
• Opt out of sale— we do not sell personal information, so there is nothing to opt out of
• Non-discrimination— we will not treat you differently for exercising your rights

Categories of Personal Information Collected (per CCPA definitions):

• Identifiers: email address, Stripe customer ID
• Internet activity: hashed IP addresses, hashed user agents, render counts
• Commercial information: subscription plan, billing period

We do not sell personal information. We do not share personal information for cross-context behavioral advertising.