What stays private
Calls and messages you place through CloakID use a persona’s number instead of your personal caller ID. We still need your real mobile number for your account and sign-in. We do not sell your account or communications data.
CloakID is not an anonymous or end-to-end encrypted phone network. Carriers handle calls and messages, and our screening providers process caller speech. An allowed call is a screening outcome, not proof of the caller’s identity. Avoid sharing sensitive information solely because a caller passed screening.
Storage and encryption keys
Your account phone number uses application-level Fernet encryption, with a separate hash for lookup. Voicemail audio is encrypted before it is stored in Amazon S3, with an additional layer of S3 encryption. Voicemail transcription text is encrypted in the database. Other app records, including screening transcripts, should not be assumed to have the same field-level encryption.
These keys are managed by CloakID’s server environment. The service can decrypt protected data when needed to operate your account or play a voicemail. This is server-managed encryption, not encryption with a key that only you hold.
App and website connections to the public API use HTTPS. Ordinary carrier calls and SMS/MMS do not provide end-to-end encryption through CloakID.
Who processes your data
- Telnyx: provisions numbers, handles calls and SMS/MMS, delivers sign-in codes, and processes voicemail. It receives phone numbers, communication content, and routing metadata needed for delivery.
- Deepgram and OpenAI: process screening audio, transcripts, and relevant persona context for transcription and screening. Telnyx transcription is also used in supported call flows and as a fallback.
- AWS and our database hosting provider: host service data and stored media. Voicemail audio is stored in S3.
- Firebase and Sentry: support push notifications and error reporting.
- Stripe: handles web and Android subscriptions and payment details; Apple handles iPhone in-app subscriptions. CloakID receives billing status, not your full card details.
- Phone-validation services: Telnyx number lookup and configured signup checks help assess numbers and prevent abuse.
The Privacy Policy describes these providers and the website’s separate analytics and advertising measurement. Provider records have their own retention practices; we do not promise that deleting something in CloakID immediately erases every provider copy.
What we keep, and for how long
- Screening: live audio is processed for transcription. Recorded screening segments, when used, are scheduled for deletion after processing, with cleanup for leftover provider recordings. Screening transcripts and call outcomes can remain in your account’s call history.
- Voicemail: audio is stored for playback and transcripts for reading. You can delete individual voicemails in the app. Media and account-record deletion are separate processes.
- Public demo: a scheduled cleanup removes caller numbers and words from demo call records once they are older than 24 hours. Demo rate-limit counters can last up to 26 hours. Provider retention is separate, and failed cleanup is retried.
- Account deletion: removes the account and associated app records and requests number release. Message-media cleanup runs separately. Stored media, backups, billing records, and provider records may persist beyond account deletion; see the deletion page.
- Trial-abuse prevention: for trial accounts that never subscribed, a one-way phone-number hash may remain for up to 180 days after deletion to prevent repeat trials.
We do not promise a single deletion deadline for every data category. Contact privacy@cloakid.app for a specific retention or deletion request.
Account and device access
Sign-in verifies your mobile number. Mobile credentials use platform secure storage, and biometric unlock is optional. Your operating system handles biometric verification; CloakID does not receive your fingerprint or face template.
Screening is automated. Authorized support or abuse investigations may require access to relevant account records. App data access and internal administration are protected by authentication and access controls. These protections are not a claim of independent security certification.
Report a security issue
Email privacy@cloakid.app with a description and reproduction steps. Please omit passwords, sign-in codes, payment details, and other people’s communication content. We can coordinate a suitable way to share sensitive evidence if needed.