Privacy & data
Understand what the website and app collect, which provider receives a session, what each privacy tier means, and what Cloaky stores on your device.
Cloaky is a pseudonymous AI workbench. It keeps one agent experience around the intelligence you choose and names the provider and privacy tier on every session.
Effective date: July 31, 2026. This page explains the current data practices for cloaky.dev and the Cloaky macOS beta. It is a practical notice, not a promise that a provider or tool will never retain or disclose data. The route, provider terms, approved tools, device, and your settings all matter.
What we collect directly
Website and beta signup
If you join the public-beta list, we collect the email address you submit, the time it was added, and which signup you chose (beta tester or team deployment). We use the address only to follow up on that signup — tester onboarding, or deployment guidance. We do not use it for a newsletter or follow-up sequence. We do not ask for a name or phone number. The address is stored in our Upstash Redis account, accessed through the site’s serverless deployment.
You can ask us to remove or correct a signup address by emailing privacy@cloaky.dev from that address. We keep it until the follow-up is complete, you ask us to delete it, or a longer period is required for legal, security, or record-keeping reasons. Operational backups and provider logs may take longer to clear.
The site also receives ordinary technical information needed to deliver and protect a web request, such as request time, URL, browser/device information, and network information in hosting or security logs. We use it to operate the site, prevent abuse, debug failures, and understand aggregate traffic.
The site currently does not use advertising cookies or an account login. The theme choice and dismissed-notice state are stored in your browser’s local storage. Vercel Web Analytics is enabled for aggregate page-view measurement; Vercel says its Web Analytics uses anonymized data and does not use cookies. Vercel Speed Insights measures performance and Core Web Vitals. These are third-party services and their own privacy terms apply.
App and support
The app stores the working state needed by the workbench on your device: settings, provider configuration, session and recovery metadata, cost records, command history, drafts, and phone-pairing state. The underlying agent engine may retain its own transcripts. Provider credentials remain on the device and are not sent to the browser.
If you contact us, we receive the information you choose to include, such as your email address, app version, screenshots, logs, and the description of a problem. Do not send secrets or sensitive project content in a support request.
Feedback submissions
The feedback form collects the category, note, optional expected outcome, provider or route, Cloaky version, and optional follow-up email you submit. The text is stored in our Upstash Redis account for human review. The current form does not upload files and does not send your submission to a model or automatic summarizer. If you email a screenshot or log to feedback@cloaky.dev, that message and attachment are handled through our email system instead.
Do not include passwords, API keys, private keys, confidential client data, or other sensitive information. We use feedback to understand problems, respond when you ask for follow-up, and improve Cloaky. We may retain submissions as long as reasonably needed for those purposes, security, and record-keeping; ask privacy@cloaky.dev if you need a submission removed.
Cloaky is not your inference provider. Data handling follows the route you enable: some providers know the account behind a session, Venice can separate your identity from an upstream provider, and local models involve no inference provider at all. The session badge makes that route explicit before work begins.
Provider routes at a glance
| Route | Identity and operational data | Prompt handling |
|---|---|---|
| Local — Ollama or LM Studio | No cloud account is involved in inference. | The prompt is processed by the model service on this machine. |
| Venice · private | Venice receives the account and operational metadata required for billing, abuse prevention, and reliability. | Venice provides a contract-enforced zero-retention tier: prompt and response content is processed for inference and not retained after the request completes. |
| Venice · anonymized | Venice routes the request while withholding your identity from the upstream provider. | The upstream provider may see the prompt. This protects identity; it is not a zero-retention guarantee. |
| Claude direct | Anthropic receives the account associated with your Claude subscription. | Anthropic’s terms and retention policy apply. |
| Coding plans and compatible providers | The provider receives the configured account and operational data. | That provider’s terms apply. Cloaky does not label these routes private. |
Use a local model when keeping inference on your machine is the priority and the model is capable enough for the work. Venice private is the first hosted route to consider when you want cloud capability with a contractual retention guarantee. Direct providers remain available when you need a particular model or want to use an account you already trust.
How to read the session badge
Provider choice is fixed when a session starts. Cloaky shows the route that actually reached the model and does not silently move a session to another provider when the selected route is unavailable.
| Label | What it means |
|---|---|
| Local | Inference is served by Ollama or LM Studio through this machine’s loopback connection. |
| E2EE + TEE | Selected Venice models can encrypt tool-free turns after the client checks the available attestation evidence. |
| Private | Venice’s contractual zero-retention tier. This is a provider commitment, not an end-to-end encryption claim. |
| Anonymized | Venice withholds your identity from the upstream provider, which may still receive the prompt. |
Encryption and tool use
Venice’s encrypted route does not return the structured tool calls a coding agent needs. On a supported model, tool-free turns can use E2EE + TEE; turns that require tools use Venice private and its contractual zero-retention guarantee. Cloaky reports the route that was used instead of presenting the stronger label when it did not apply.
Attestation is useful but bounded evidence. Cloaky does not currently verify the quote signature against a published reference measurement, so the product does not present attestation as an independent cryptographic proof.
Network access beyond inference
Model inference is only one form of network access. Content may also leave the device when you approve or enable:
- WebFetch, WebSearch, MCP servers, or network-capable shell commands;
- a provider’s account, billing, abuse-prevention, or operational systems;
- the optional model gallery, which can contact a model registry when opened;
- the packaged app’s update check; or
- the website’s aggregate, cookieless analytics and performance measurement.
Those actions are not covered by Venice’s inference-retention commitment. Cloaky makes network-capable actions visible and asks for approval where the workbench can intervene. A local session means model inference is local; it does not automatically make every approved tool action offline.
We do not sell your prompts, code, or provider credentials. We do not use private app content to train a general-purpose model. However, the selected provider, tool, registry, or account system may process the content you send to it under its own terms. If you use a direct provider or a network-capable tool, that service is a separate recipient.
Data stored on your device
Cloaky stores the working state required by the workbench: settings, provider configuration, session and recovery metadata, cost records, command history, drafts, and phone-pairing state. The underlying agent engine may also keep its own transcripts.
Use Settings → Start fresh to remove local history. Start fresh preserves credentials, logins, engine settings, and phone pairings so you can clear work without disconnecting the app.
Provider credentials remain on the device and are not sent to the browser. Never paste a credential into a prompt, issue, social post, or support reply.
Assists and automations
Session headlines follow the provider for the active session. Other assists use the providers you configure for that purpose, in the order shown in Settings. If the selected provider cannot start, the assist stops and explains the problem; it does not quietly send the content elsewhere.
If content should not leave the device, keep the session local and avoid network-capable tools. The provider badge identifies the inference route, and your approvals determine which additional actions run.
Your choices and privacy rights
You can choose a local route, decline a provider, disable network-capable tools, skip the beta list, or ask us to delete information we hold. Depending on where you live, you may also have rights to access, correct, delete, or receive a copy of personal information, object to or restrict certain uses, or complain to a privacy regulator. Send a request to privacy@cloaky.dev. We may need to verify the request and may retain a limited record of it to comply with law and prevent abuse.
We do not currently sell or share personal information for cross-context behavioral advertising. If that changes, this page and any legally required choice mechanism will be updated before the change takes effect.
Security and changes
We use reasonable administrative, technical, and organizational safeguards, but no device, network, provider, or software system is perfectly secure. You are responsible for backups, credential hygiene, permissions, and choosing a route appropriate for the sensitivity of your work.
We may update this page as the beta changes. The effective date above will change with a material update. If a future feature changes what we collect or where content goes, we will update the relevant disclosure before or when the feature is introduced.
Quick reference
Use local models when inference must remain on your machine. Use Venice private when you want hosted capability with a zero-retention contract. Use a direct provider when its model or subscription is the right fit. Cloaky keeps the route visible; the guarantee belongs to the provider you select.
For the operator’s contract terms, risk allocation, and beta disclaimer, read the Terms of Use. For practical safeguards, read Safety & responsible use.