0 Concern4 Mixed0 Positive
C+63 / 100
In Plain English
Cloaked is a privacy-masking service with a strong mission, an 'encrypted even from us' architecture claim, and explicit commitments to never sell data, read emails, read texts, or listen to calls — but significant product complexity means multiple features are governed by third-party policies rather than Cloaked's own: the VPN is powered by PureVPN (and PureVPN's policy governs it), financial account connections use Plaid/Stripe/PayPal under their own policies, and the Inbox Cleaner requires Gmail access despite the high-profile 'never read your emails' pledge; additionally, it is a US company governed by Massachusetts law, no security certifications are named, data retention is vague, and it ignores Do Not Track signals.
Category Breakdown
Known data breaches
No known public data breaches
Cloaked does not appear in the Have I Been Pwned database of publicly disclosed data breaches.
How Cloaked could earn a higher grade
Recommended changes
- Explicitly clarify how the Inbox Cleaner feature operates alongside the 'we will NEVER read your emails' commitment — explain the distinction between automated algorithmic processing and human reading, and specify what inbox data is retained, for how long, and whether it is used for any purpose beyond the immediate cleaning task.
- Publish specific data retention periods for each data category — SSN monitoring data, Gmail access tokens, proxy identity records, and account data — rather than the fully open-ended 'as long as necessary' framing.
- Add advance user notification before any business transfer or acquisition, with the right to delete data before the transfer, given the sensitivity of proxy identity, SSN, and financial data held and the likelihood of future acquisition for a Series B startup.
- Honour the Do Not Track browser signal, or provide an accessible in-product universal opt-out mechanism — not honouring DNT is inconsistent with a privacy-first brand positioning.
- Pursue and publish an independent security certification (SOC 2 Type II or ISO 27001) for the core Cloaked data handling practices, not just infrastructure-level compliance.
- Consider moving to a VPN partner whose own privacy policy is at a higher grade than PureVPN's C+ (60), given that the VPN product's privacy is governed entirely by the partner's practices.
Frequently asked questions
Alternatives to Cloaked
A
Standard Notes
87/100
Standard Notes is an end-to-end encrypted note-taking app that genuinely cannot read your notes; analytics are self-host…
B+
AdGuard
82/100
AdGuard filters ads and trackers locally on your device so it never sees your browsing history, stores only an email add…
B+
Bitwarden
79/100
Bitwarden is an open source password manager that encrypts your vault on-device so it cannot read your passwords — but i…
B
Keeper
76/100
Keeper is a zero-knowledge password manager with SOC 2, ISO 27001, and FedRAMP High certification — among the strongest…