Help with Cloak Proxy.

Cloak Proxy for iPad runs a proxy on the iPad itself and shows the requests the iPad's apps make: the traffic list and inspector, the debugging tools, Insights and the API client. Everything stays on the iPad.

Capture on this iPad

On the first screen, tap Capture on this iPad. A setup guide takes you through each step and notices when you finish it:

1. Download the profile. Tap Download in Safari, then Allow when Safari asks.
2. Install and trust it. See the certificate below.
3. Set the Wi‑Fi proxy to Cloak Proxy. See Wi‑Fi proxy setup.
4. Test it. The guide opens example.com and checks that its request arrives.

Then choose which hosts to read. Other traffic passes through encrypted. Long-press one of a host's requests in the traffic list and choose Decrypt HTTPS for this host, or add it in Settings › HTTPS › Decrypted hosts.

Keep Cloak Proxy on screen while you test. iPadOS pauses apps in the background, so capture stops when Cloak Proxy isn't visible. Put it next to the app you're testing in Split View, Slide Over or Stage Manager. The status line at the bottom of the traffic list says Capture ready when everything is set, or what's missing; tap it to open the guide at that step.

Try it with sample traffic

To look around without any setup, tap Try with sample traffic on the first screen. It shows example requests from fictional apps and hosts, the debugging tools with example rules, Insights, Trace Value, Privacy Map and an example API client workspace. Nothing is saved. To leave it, tap Choose a mode (or Exit sample) in the bar at the top of the list. It's also in Settings and on empty traffic lists.

Install and remove the certificate

To read HTTPS, the iPad must trust Cloak Proxy's root certificate, Cloak Proxy CA. It's made on your iPad, and its private key never leaves Cloak Proxy; Subcloak never has it.

1. After downloading the profile, open Settings › General › VPN & Device Management, tap the downloaded profile and install it.
2. Open Settings › General › About › Certificate Trust Settings and turn on full trust for Cloak Proxy CA.

To remove it, open Settings › General › VPN & Device Management, tap Cloak Proxy CA, then Remove Profile. Deleting the app doesn't remove the profile, so remove it there when you no longer need it. To only stop it working for a while, turn off its switch in Certificate Trust Settings.

Wi‑Fi proxy setup

Open Settings › Wi‑Fi, tap ⓘ next to your network, then Configure Proxy. Choose Manual, with server 127.0.0.1 and the port Cloak Proxy shows (9090 unless you changed it). Leave Authentication off. Do this for each Wi‑Fi network you test on.

When you're done, set Configure Proxy back to Off. Otherwise apps can't reach the internet while Cloak Proxy isn't running. In the app, long-press the status line or use Settings › Turn off capture, which walks you through it.

Common problems

“Profile Downloaded” doesn't show in Settings

Safari only keeps a downloaded profile for about 8 minutes. Open the setup guide (tap the status line at the bottom of the traffic list, or Settings › Setup guide), tap Download in Safari again, tap Allow, and install it in VPN & Device Management straight away.

HTTPS requests stay encrypted, or apps say the connection isn't private

Installing the profile isn't enough on its own: turn on full trust in Certificate Trust Settings. Then check the host is in the decrypt list (Settings › HTTPS › Decrypted hosts).

Some apps pin their certificates and refuse any other, so they fail while their host is decrypted. Remove the host from the decrypt list and their traffic passes through encrypted again.

No requests appear

• Check the Wi‑Fi proxy is Manual, with 127.0.0.1 and the port Cloak Proxy shows.
• Keep Cloak Proxy on screen: capture stops while it's in the background.
• Apps that ignore the system proxy aren't captured. Cloak Proxy for iPad doesn't use a VPN.
• Tap the status line at the bottom of the traffic list. It says what's missing and opens the guide at that step.

Apps can't reach the internet after testing

The Wi‑Fi proxy still points at Cloak Proxy, which isn't running. Set Configure Proxy back to Off, as in Wi‑Fi proxy setup.

Withdraw consent for AI features

Agent Mode and AI requests use your own API key with the provider you choose, and ask before they first send anything to it. To withdraw that, open Settings › AI providers and tap Revoke.

Still stuck? Email hello@subcloak.com or open an issue on GitHub.