What Connect keeps local—and what the website receives.

Effective August 1, 2026. This policy covers cloakshift.ai, purchases, support communications, and CloakShift Connect.

Connect data

Private work is designed to stay on your computer.

Original prompts and files

With Protection Mode on, original drafts and file bytes are processed by the local helper. Connect does not send them to CloakShift, NextWave.ai, Vercel, Supabase, analytics services, or a model provider.

Protected AI requests

The protected content you choose to send goes to your selected supported AI service and is governed by the account settings, privacy policy, and terms that apply to your use of that service.

Local vaults and settings

Conversation mappings, settings, custom templates, and optional local logs are stored locally in encrypted form. The installed helper protects its master key with macOS Keychain or Windows per-user DPAPI.

No prompt telemetry

The extension and helper do not send product analytics, prompts, files, mappings, restored content, or remote activity logs to CloakShift. The helper does make a limited subscription check described below.

Website and communications

Information needed to run the service.

Hosting information

Our hosting and security providers may process standard request information such as IP address, browser type, requested route, referral information, and timestamp.

Purchases and support

Stripe processes checkout, including complimentary promotion codes, and may provide us with your email, customer identifier, subscription status, scheduled access end, and transaction details. We do not receive your full card number. A 100%-off complimentary checkout does not request a payment method. If you email us or submit the support form, we receive the address and information you provide. Website support requests are stored with Supabase.

Account and device access

Supabase stores your account email, passwordless sign-in account identifier, subscription status and expiry, and registered-computer records. Accounts also include Stripe customer and subscription identifiers. A computer record includes a random device identifier, one-way device-secret hash, platform, computer label, app version, device slot, and access-check timestamps. Connect sends this limited information to verify access about once per day; it does not send your prompts, files, mappings, or restored answers.

Cookies

Checkout and payment providers may use essential security, fraud-prevention, and transaction cookies. We do not use advertising cookies.

Retention

We retain account, subscription, promotion-code, registered-computer, billing, and support records only as long as reasonably needed to provide access, respond, prevent fraud, keep required financial records, protect the service, and meet legal obligations.

Choices and contact

Ask about your information.

Local deletion

Connect provides local conversation-data deletion and an explicit purge uninstall path. Deleting a conversation in your AI service is separate from that service's own retention behavior.

Privacy requests

Email info@cloakshift.ai with “CloakShift Privacy” in the subject. We may need reasonable verification before acting on a request.

Security

No system is perfectly secure. Keep your Windows PC or Mac updated, protect your local account, and avoid sending secrets or private documents to support.

Policy changes

We may update this policy as Connect changes. We will update the effective date and provide additional notice where required.