Privacy policy

This policy explains what Subcloak ("we") collects when you visit subcloak.com, use our apps or work with us, and how we protect it. The short version: we collect very little, we don't sell anything, Cloak Proxy keeps your traffic on your computer, its optional Personal Cloud and Team Cloud are end-to-end encrypted (apart from Team Cloud's monitors and hosted mocks, which run on our servers), Cloak Watch checks your Mac without uploading anything about it, and client test data is deleted 30 days after a job ends.

1. When you visit the website

The site has no advertising trackers, no tracking cookies and no third-party scripts on most pages.

• Analytics. We count visits ourselves, without cookies and without storing anything on your device. Each page tells our server which page you opened, the page or campaign tag that brought you to it, your window width and language and, when you leave, how long the page was in view while you were using it and how far you scrolled. We also count clicks on downloads and on links to other sites. Our server adds the country, region and city Cloudflare works out from your IP address, and your device type, browser and operating system. To tell visitors apart, it combines your IP address and browser with a random value that changes every day and is then deleted, so the result can't be turned back into your IP address or linked to your visits on other days. We don't store your IP address. We keep these counts for 400 days and use them only to see how the site is used. Cloudflare Web Analytics also counts visits, without cookies and without building a profile of you.
• Server logs. Our hosting provider keeps standard request logs (IP address, browser, page requested) for security and reliability, for a short period.
• Currency. To show prices in your currency, your browser asks our host, Cloudflare, which country your connection comes from (worked out from your IP address). It keeps the country code in your browser's local storage. We don't receive or store it.
• Free MCP check. When you use the free check, the URL you enter is sent to our checker at check.subcloak.com, which reads that server's public sign-in metadata. We keep the result for 10 minutes so repeat checks don't reach the server again, and a counter of checks per IP address for up to an hour to stop abuse. Nothing else is stored.
• Downloading Cloak Proxy. You can download Cloak Proxy without giving us anything. For every download, our download service at download.subcloak.com adds one to a daily count by platform and by where the visit came from (a campaign tag in the link, such as utm_source, or the referring website's name). That count holds no personal data. If you choose to give your name and email, we also store them with the platform, the country your connection comes from (as Cloudflare reports it, not your IP address), where the visit came from, and when and how many times you downloaded. We use them only to tell you about Cloak Proxy releases, such as new versions and platforms. You can ask us to stop emailing you, or to delete your details, at any time. What the app itself sends is in section 2.
• Platform waitlist. If you ask to hear when Cloak Proxy reaches another platform, or when its cloud plans open, we store your email, which one you picked, your connection's country and where the visit came from, and email you once when it's ready. You can ask us to delete it at any time.
• Cloak Watch live feed list. If you ask to hear when the Cloak Watch live feed is ready, we store your email, your connection's country and where the visit came from, and email you once when it's ready. You can ask us to delete it at any time.
• Booking a call. The booking page embeds Cal.com. If you book, Cal.com processes your name, email and any notes you add, under its own privacy policy, and shares them with us.

2. When you use Cloak Proxy

This section covers the Cloak Proxy apps. Your traffic never leaves your computer unless you send it somewhere. Unless you turn on Personal Cloud (section 4) or join a Team Cloud team (section 5), the only thing that contacts Subcloak is the optional update check. The apps have no analytics, no advertising and no crash reporting, and no account or sign-in unless you use Cloud.

• What stays on your device. The traffic Cloak Proxy captures (with request and response headers and bodies, which can contain tokens and personal data), your rules and settings, your API client workspace, and the root certificate it creates for decrypting HTTPS, with its private key. On a Mac they're in ~/Library/Application Support/CloakProxy and the app's preferences; on Linux in ~/.config/cloakproxy and ~/.local/share/cloakproxy; on iPhone and iPad inside the app. Secrets you keep in the API client's vault, such as AI provider keys, are in your Mac's Keychain or your Linux desktop's secret store. The private key never leaves your device. We can't see any of this.
• The update check. Cloak Proxy can ask our download service, download.subcloak.com, for the latest version number: when you choose Check for Updates, or once a day if automatic checks are on. Automatic checks are off until you turn them on in Settings › General, on the Mac and, from version 0.4.2, on Linux (Linux versions 0.4.1 and earlier checked once a day unless you turned it off). The request has no cookies, no identifiers and nothing about you or your traffic. Like any web request, it reaches our host, Cloudflare, from your IP address; our download service doesn't store it.
• Anonymous install counts (optional, from version 0.4.2). If you turn on Help count active installs (anonymous) in Settings › General, off by default, each update check also sends the app version and platform, for example 0.4.2 and mac-arm64. We add one to a count per day, version and platform, and keep nothing else: no IP address, no ID, no browser or device details. We use the counts only to know how many installs are in use and which versions to support.
• AI providers, with your key and your consent. Agent Mode and AI requests in the API client send data to the AI provider you choose (such as Anthropic, OpenAI or Google, or a server you run), using your own API key, straight from your device. From version 0.4.2, the first time each provider is used, the app shows what will be sent (your prompt and conversation, and for Agent Mode the request you're working on and what the agent reads from your workspace) and to which endpoint, and sends nothing until you allow it. You can revoke that in Settings › Privacy. The provider handles the data under its own terms. Subcloak doesn't receive it. AI assistants you connect to Cloak Proxy's MCP server read your traffic through their own model, under their provider's terms; Cloak Proxy doesn't send it anywhere itself.
• Things you choose to send. The app also connects to the internet when you ask it to: to forward your apps' traffic while you capture, to send API client requests, to publish a GitHub Gist or file a bug report in GitHub, Jira or Linear with your own token, to download npm packages for scripts from jsDelivr, to pull or push your workspace's Git remote, and to look up domains you capture for apps that ignore the proxy (falling back to the public DNS servers 1.1.1.1 and 8.8.8.8). Live sharing and the iPad companion connect devices on your own network directly to your computer. Bug reports, Gists, live shares and AI assistants get tokens, cookies, keys and passwords redacted by default, and exports can redact them too. Each of these goes to the service you chose, under its terms, and not to us.
• App Capture and the browser extension. App Capture's network extension (on the Mac, from version 0.5.0) passes the connections of the apps you pick to Cloak Proxy on your Mac, which handles them like the rest of your captured traffic. The browser extension, including the Safari extension inside the Mac app, talks only to Cloak Proxy on your own computer (127.0.0.1). Neither sends anything to Subcloak.
• VPN capture (iPhone and iPad). From version 1.1, if you turn on VPN capture, the app's network extension runs Cloak Proxy's proxy on your iPhone or iPad and points its apps at it. iOS shows it as a VPN, but nothing is sent through it to Subcloak or anyone else: each request goes from your device to the server the app was talking to, and is captured like the rest of your traffic. Turn it off in the app's Settings › VPN capture or in the Settings app › VPN. The iPhone and iPad app doesn't use the camera.
• Our commitment. We never sell, use or disclose the traffic or data you work with in Cloak Proxy; we don't receive it. What Cloud stores for you, if you turn it on, is in section 4. If we ever add anything that sends data from the apps to us, it will be off until you turn it on, and listed here first.

To remove everything Cloak Proxy stored, follow Remove everything in the docs, and remove its certificate from any device you set up.

3. When you use Cloak Watch

Cloak Watch is local first. It checks your Mac on your Mac: nothing about what's installed on it is sent to us or anyone else. It has no account, no sign-in, no advertising and no analytics.

• What stays on your Mac. The inventory of your packages, extensions, MCP servers, agent configs, launch items and credential files; every match and incident; the AI Activity history (which apps talk to which AI providers, and Claude Code sessions, received on your Mac); and the location of any plain-text secrets it finds. Secret values are masked, never stored and never sent.
• What leaves your Mac. Only two things. First, downloading the threat feed and checking for updates: these are requests for static files, so like any web request our host, Cloudflare, sees your IP address and the time, plus the app's version. They carry nothing about your Mac. Second, on a paid plan, exchanging your licence key: once, when you activate, and when the entitlement is renewed, the app sends the licence key, a random install ID made by the app, and the app's version, and gets back a signed entitlement. Telemetry is off; if you choose to turn on feed-health reports, they contain only feed timing and error codes.
• What we keep for a paid plan. A hash of your licence key (not the key itself), the plan, its expiry date, the number of Macs it allows and the random install IDs using it, so we can enforce that limit and let you move the key. We don't receive your name or card details from the app.

4. When you use Personal Cloud

Personal Cloud ("Cloud" below) is an optional paid service that syncs your Cloak Proxy setup between your Macs and shares captured requests as links. Nothing in this section applies unless you turn Cloud on; the free app needs no account. Cloud is end-to-end encrypted: your devices encrypt what you sync and share before it leaves them, and the keys stay on your enrolled devices and in your Recovery Kit.

• What we can't see. The contents of what you sync (rules, mock sets, API client workspaces, environments, saved queries, filters and highlights) and of your share links. For these, our servers only ever store and pass on ciphertext, which we can't decrypt. A share link's key is in the link itself, in the part after the #, which browsers don't send to our servers. Share links are redacted by default.
• What we can see. Your account email, which we store in two forms: a keyed hash, to find your account, and an encrypted copy, used only to send you sign-in codes and messages about your account: a welcome message when your subscription starts, and, if someone asks to delete the account, a notice with a link that cancels the deletion. The public keys of your enrolled devices and basic metadata about them. Device names are stored encrypted, with one exception: when a Mac asks to join your account, we hold its name in plain text while the request is pending, so your other Mac can show it, and remove it once the request is approved, denied or expires. The sizes and times of what you store and share, the settings our servers enforce for share links, such as expiry and view limits, and when and from which country each link is opened (not the IP address). The country your connection comes from when you sign in, worked out from your IP address. From Polar, your subscription and customer IDs, your plan's billing status and its period dates. Polar's messages to us also include your email address, but for Cloud we don't store it. Like any web request, Cloud requests reach our host, Cloudflare, from your IP address.
• Features that run on our servers. Personal Cloud has no features that run on our servers in readable form. If we add any, the app will say so before you use them, and we'll update this policy first. Team Cloud's monitors and hosted mocks do run on our servers in readable form; see section 5.
• Where it's stored. On Cloudflare's network (Workers, Durable Objects, R2 storage and D1 databases). We don't currently pin Cloud data to one country or region, so it may be stored in the United States or near where you first use Cloud.
• Who processes it. Cloudflare hosts and stores Cloud and sends its sign-in and account emails (Cloudflare Email Sending). Polar (Polar Software, Inc.) handles payments as our merchant of record; see section 6.
• How long we keep it. While your account is active, we keep what you store until you delete it. When a paid period ends without renewal (or, after a failed renewal payment, when Polar's 7 days of retries run out), or straight away when a payment is fully refunded, Cloud becomes read-only and your share links stop working. We keep your Cloud data for 30 days after that, so you can restore or download it, or subscribe again and have everything back as it was; then we delete all of it from our servers. If you delete your Cloud account, from the app or, if you no longer have an enrolled Mac, by emailing us from the account's address, we delete your Cloud data from our servers after 72 hours, during which the link in our email or any of your Macs can cancel it. Deleted data ages out of our backups within 30 days. We keep only the account and billing records we need for tax, accounting and to prevent abuse. Your Macs keep their own copy of what you sync, and deleting Cloud data never touches it.

5. When your organisation uses Team Cloud

Team Cloud is Cloak Proxy's paid plan for teams. An organisation (the customer) buys it in the Subcloak console at console.subcloak.com and invites its people. The team's data, such as its workspaces, rule and mock sets, library, findings, comments, agent setups and vault, is end-to-end encrypted on members' devices before it's uploaded, with keys held on members' devices, on the CI tokens the customer creates (for the spaces it gives them) and in the team's printed Team Recovery Kit. Our servers store and pass on ciphertext for it that we can't decrypt, and can't read the names of any of it. If a team's admin turns on automatic approval of new devices after single sign-on, our server and the team's identity provider can admit a device as an existing member, which can then read what that member can; it's off unless an admin turns it on. To run the service, we do see the following.

• People and billing. The team's name; the email addresses and display names of the owner, billing managers and members; their roles; the number of seats; and the subscription's billing state. As for Personal Cloud, each email address is stored as a keyed hash and an encrypted copy, which we use to send sign-in codes, invitations, notifications and billing messages. The team's name is stored encrypted with our own key, not end-to-end, because it appears in the console and in our emails.
• Devices. For each member's devices: platform, app version, when it was last seen, and the country its connection came from. Device names are stored encrypted, except that a device asking to join sends its name unencrypted with the request, so the team's admins can see which device is asking.
• Activity metadata. Opaque ids, kinds and sizes of what's stored, when it was written and by whom, and who has which role in each shared space. The audit log: who did what kind of action, when, from which country, and on which item by id, never names or content. Notification metadata: who mentioned, asked for a review from or assigned whom, when, and in which space by id, never the comment text. For live pair debugging, who is connected and how much data passes, never the traffic. Network addresses are stored only as salted hashes.
• Console sign-ins. For each console session: when it started and was last used, the country, how the person signed in, and a hash of the browser's user agent so they can tell their sessions apart; for each passkey, the name the person gave it.
• Single sign-on and SCIM. If the team uses single sign-on: its identity provider's issuer, and each person's subject id and email. If it uses SCIM, for each person: the user name, email address, display name and whether they're active, plus the identity provider's own id for them (externalId), which Okta and Entra use to match people. We drop every other attribute the identity provider sends.
• What runs readable on our servers. Monitors and hosted mocks are not end-to-end encrypted. When a member publishes a monitor, we can read its request (address, headers, body and any secret they chose to include) and every result. When a member publishes a hosted mock, we can read the published mock set, which is public to anyone with its address, and we count its requests. The requests sent to a hosted mock pass through our servers, which can read them, though we don't keep them. Cloak Proxy warns before anything is published. We store these copies encrypted with our own key, and use them only to run the feature. Secrets for alert integrations (such as Slack webhook addresses and PagerDuty or Opsgenie keys) and single sign-on client secrets are stored the same way.
• CI tokens. Each token's label, which spaces it can read (by id), and its run counts and sizes. Not its keys, and not the recordings it uploads, which are encrypted to the team.
• Who processes it. Cloudflare hosts and stores Team Cloud and sends its email. Polar handles payments as our merchant of record (section 6). Slack, PagerDuty and Opsgenie receive monitor alerts only when the team sets them up, and the alert content goes to them. Cal.com handles bookings for the onboarding call. The team's own identity provider, if it uses one, is the customer's choice, not ours.
• How long we keep it. The audit log for 1 year; earlier versions and deleted items for 90 days, except restricted spaces' earlier access lists, kept until the team is deleted so every device can verify the current one; notifications for 90 days; monitor results for 30 days; CI recordings for 30 days unless someone keeps them; library entries until they're deleted or the team's retention policy removes them; a removed member's address and name, kept encrypted with our key so the console and audit log can still name them, until the team is deleted. When a team's subscription ends (after up to 7 days of payment retries), it's read-only for 30 days and then everything is deleted from our servers, usually within a few days of that; when a team starts over with new keys, we delete the old data by hand within 30 days. Deleted data ages out of our backups within 30 days. We keep only the account and billing records we need for tax, accounting and to prevent abuse.
• Who is responsible. The customer is the controller of its team data, and decides who may join and what goes in. Subcloak processes the metadata above on the customer's behalf to run the service, and is the controller of the billing and account records we keep for ourselves. A data processing agreement is available on request. Members who want to access or delete team data should ask their organisation; we'll help the organisation with any request we can act on.

6. Payments

Paid plans, Cloak Watch's live feed and Cloak Proxy's Personal Cloud and Team Cloud, are sold through Polar (Polar Software, Inc.), our reseller and merchant of record. Polar collects and processes your payment details, billing address and tax information under its own privacy policy. For the Cloak Watch live feed, it sends us what we need to deliver and support your subscription: your email address, the plan, the country, the order and subscription status, and the amounts. For Personal Cloud, Polar's messages include your email address, plan and billing status, and its subscription and customer IDs; we store only the IDs, the status and the period dates, not the email. For Team Cloud, Polar's messages also include the number of seats and the amounts of orders, which we store to show the team's billing in the console. You can manage a subscription, change your card or download invoices in Polar's customer portal at polar.sh/subcloak/portal. Subcloak never receives or stores your card details. We keep order records for as long as tax law requires.

When you buy the live feed, our licence server keeps a one-way, keyed hash of the email address you paid with, never the address itself, and uses it only to let you recover a lost licence key: you type your email and order number, and we check that they match. Polar, our merchant of record, holds your actual email address and payment details.

7. When you contact us

If you email us or book a call, we keep your name, work email, company and whatever you tell us about your project. We use it only to reply, scope and deliver work. We don't add you to marketing lists. We keep enquiry records for up to 24 months after our last contact, unless you ask us to delete them sooner.

8. When we test your systems

Client engagements are governed by the signed contract and statement of work, which take precedence over this policy. In every engagement:

• Authorization first. We test only what a client representative has authorized in writing.
• Minimal collection. We collect only the evidence needed to show a finding. Where personal data appears in evidence, we redact it in the report.
• Storage. Working data is kept encrypted, on our own devices and accounts, never on shared or client-unapproved services. Credentials and files are exchanged through an end-to-end encrypted channel.
• No third-party AI without consent. Client data is not sent to third-party AI services unless the client agrees in writing. When AI tools are used, they run on API terms with zero data retention.
• Deletion. Working data is deleted 30 days after the client accepts the report, and we send a deletion certificate. We keep the final report and invoice records as required by law.
• People. Only the testers named in the statement of work can access client data.

9. Who we share data with

We don't sell, rent or trade personal data. We share it only with providers that help us run the business (email, hosting, scheduling, accounting), including Cloudflare for hosting and Cloud's email, with Polar as the merchant of record for app subscriptions, and, for Team Cloud, the alert services a team chooses (section 5), under their data-processing terms, or with authorities when the law requires it.

10. Your rights

Depending on where you live, including under India's Digital Personal Data Protection Act and the EU and UK GDPR, you can ask to access, correct or delete your data, object to how we use it, or receive a copy. Email hello@subcloak.com with the subject "Privacy request". We reply within 30 days. You can also complain to your local data-protection authority.

For people in the EU and UK, our legal bases are: replying to your enquiry and improving our services (legitimate interests), delivering work you've commissioned and subscriptions you've bought (contract), and keeping tax records (legal obligation).

11. International transfers

We are based in India. If you are in the EU or UK, your data is processed in India and by our providers, using standard contractual clauses or equivalent safeguards where required.

12. Changes

If we change this policy, we'll update the date at the top. Material changes for active clients are sent by email.

13. Contact

Subcloak, Bengaluru, Karnataka, India · hello@subcloak.com · Subcloak is a Udyam-registered micro enterprise in India.