Privacy Policy

Last updated 22 August 2026

The short version: Sunda Cloak does its work entirely on your own device. Your files are never uploaded, never seen by us, and never seen by anyone else. We collect no analytics and no tracking data. That's the whole point of the product.

1. Your documents

When you cloak a document, everything happens locally on your device. Your document is never sent over the internet, never stored on a server, and never logged. We have no way to see, recover, or analyze the files you protect. When you're done, the working copy is simply gone.

2. What stays on your device

Sunda Cloak keeps a small amount of information on your own device so the app can work — for example, your trial status and your settings. None of this is ever sent to us. There are no cookies and no third-party trackers.

3. The only times we connect to a server

The extension only ever contacts a server in three narrow cases, and none of them ever includes your documents. The first is when you choose to activate or check a paid subscription. In that case it makes a single secure request to api.lemonsqueezy.com — LemonSqueezy, our payments provider and merchant of record, which has its own privacy policy.

That request contains only what's needed to confirm your subscription:

your license key (the key emailed to you when you subscribed) and an instance identifier that ties the license to this installation; and
nothing else — it never includes your document content, your file names, or any usage data.

LemonSqueezy's reply includes your own customer email address. The extension stores that only on your device, to show your subscription status, and never re-transmits it.

The second case is the built-in personal-details feature — it finds things like names, phone numbers, and account numbers in your documents so they can be protected too. To do its best work it uses an AI model that runs on your own device, and the extension downloads that model once, automatically in the background — there is no switch to flip and no button to click. The download is roughly 800 MB and comes from Hugging Face (huggingface.co and its *.hf.co download hosts), a public model-hosting service with its own privacy policy. It happens only on computers that can actually run the model (those with WebGPU support) and only while you have an active trial or subscription. That connection fetches only the model files — a fixed, pinned version — and is used for the download and nothing else: no document content, no file names, and no usage data are ever sent — the model comes down to your device and nothing about you goes up. The model is stored locally and the feature works fully offline from then on. Until the download finishes — and on computers that can't run the model — your documents are still protected by Sunda's always-on baseline protection, entirely offline.

The third case is the tripwire — optional, and off by default. If you switch it on, each cloaked copy carries one hidden reference link pointing at our own server. If some tool actually fetches that link, our server records the time, the network address (IP) and the user-agent string of whatever fetched it, filed under the opaque random id for that copy. It does not record who opened the file, which AI product was used, or anything from your document. A hit is a signal; silence tells you nothing, because many AI tools never follow links inside uploaded files.

To show you those hits, the extension opens a small dashboard page on sundacloakai.com and sends it only the opaque copy ids — never your document content. Your document names ride in the part of the web address after the #, which browsers never send to a server, so the names stay on your device even though the page can display them. Because that opaque id is the only key, anyone who holds it — the recipient of that copy, for instance — could look up the same status. That is a deliberate trade-off, and we would rather write it down than leave it out.

Leave the tripwire off and none of this exists: no link is added to your files, nothing is fetched, and there is nothing for us to record.

Those are the only connections the extension ever makes, and none of them ever carries anything from your documents — not their content, not their names.

Our data-use commitments. In line with the Chrome Web Store's Limited Use requirements:

We do not sell or transfer user data to third parties outside the approved use cases described above.
We do not use or transfer user data for purposes unrelated to the extension's single purpose (cloaking documents you choose, on your own device).
We do not use or transfer user data to determine creditworthiness or for lending purposes.

4. On-device AI

On supported computers, Sunda can use on-device AI to make protection smarter. This runs locally on your device — your document content is not sent to us, to Google, or to anyone else.

The same is true of the built-in personal-details detector described above: once its model is downloaded, everything it does happens on your device. The model files stay cached locally, what the detector finds in your documents never leaves your computer, and — like everything else in Sunda Cloak — it serves the extension's single purpose: cloaking documents you choose, on your own device.

The detector never changes or removes anything you wrote — your real details stay exactly as they are in the document. It surrounds them with hidden decoys so they are harder for an AI reader to pick out; a reader that strips hidden text still sees the real ones. It raises the cost of AI tools reading your personal details; it is not a complete defense.

5. This website

This site is built to match the product's promise. It is static, loads its own fonts, and makes no third-party requests. There is no Google Analytics, no advertising pixels, no cookies, and no cross-site tracking.

Browsing this website does not collect any personal information. There are no sign-up forms, no newsletter, and no contact form — reading these pages sends us nothing about you. Our links to the Chrome Web Store carry a plain ?ref= tag naming the page you clicked from, so we can see which pages are useful from our own server logs alone; it identifies the page, never you.

Two addresses on this domain are not ordinary pages, and both belong to the optional tripwire described in section 3: the reference link a cloaked copy can carry, and the dashboard that shows its hits. Requests to the reference link are recorded as described above — time, network address and user-agent of whatever fetched it. If you never switch the tripwire on, neither address is ever used on your behalf.

6. Children

Sunda Cloak is not directed at children under 13, and we do not knowingly collect their data.

7. Changes

If this policy changes, we'll update the date above.

8. Contact

Questions about your privacy? Email us at sundacloakai@gmail.com.