Private by design. Clear about the details.

Hosted file preparation through MCP, where enabled

After you connect your MCP client and allow its requested actions, you select and confirm a PPTX on Cloakfold’s preparation page in your browser. The file is uploaded through Cloudflare to Cloakfold’s server, hosted by Hetzner. Cloudflare and Cloakfold’s server can access the unencrypted file contents. This is not end-to-end encryption or a promise of processing only in the EU. Cloakfold creates a separate copy and a removal report. File contents, filenames and metadata values do not enter AI model or tool requests, usage statistics, email or routine logs. The free document tools process files on your device.

Connecting a client, buying units and having permission to submit a file are separate. You may submit ordinary personal files. Organisational or client files require authority and the applicable processing agreement. Cloakfold retains the exact accepted terms and processing agreement, their link to your account and order, and the verified email address for your confirmation. Stripe collects the service recipient’s individual name, optional business name, billing address and billing email for each order. Cloakfold privately retains the details supplied at completed checkout, associated payment references and reported tax totals as an unchanged record. These details do not independently verify authority or tax status. Stripe also receives order and terms references used to check and recover payments, without documents or copies of buyer, address or email details in those references. We do not send your sign-in email to Stripe or ask you to repeat your billing address on Cloakfold for new MCP orders. Historical business orders keep their original buyer and authority evidence and billing arrangements. These are protected personal data, not anonymous data.

Input files are removed when processing ends. Completed copies are encrypted and kept in temporary server memory for one hour or until you delete them earlier. Ordinary app restarts retain them, but a server reboot or memory or service failure can remove them sooner. If the service loses a ready copy early, its unit is restored once before more files are accepted. In normal operation, deletion is targeted within a further minute, and overdue files are removed before processing resumes after a restart. Outages can delay physical deletion. Documents and the keys needed to read them stay in temporary server memory and are excluded from backups. Records used to recognize repeat requests remain for 30 days, separately from required accounting and contract records. Signing out of the website ends your browser session but leaves your MCP client connected. Disconnect it on the MCP page to end its access. Copies you have already saved remain on your device.

Email and account records

If you choose human-confirmed agent registration, Cloakfold keeps protected account-hint and code records, connection permissions, expiry, abuse counters and token revocations. Registration itself sends no email. You must sign in to the same account and approve the code supplied by your agent. Permission ends after one hour or when you disconnect. Expired records are removed during later service use; protected backups can retain older records.

Cloakfold uses Cloudflare’s email service to send sign-in messages. Cloudflare processes your email address and the message containing your code for delivery. You submit your email and code to Cloakfold to verify access. Cloakfold keeps your verified email, account identity, sessions, verification records and abuse-prevention records. On the sign-in page only, Cloudflare Turnstile processes browser and connection security signals to prevent automated code requests. Cloakfold checks a short-lived, single-use result before sending a code. This check receives no documents, filenames, document metadata, email address or sign-in code from Cloakfold. Free tools and document preparation do not load this check. Cloudflare describes a controller role for signals used to improve bot detection. This account processing is separate from local document processing and normal website connection traffic.

Staying signed in

Account access requires an essential, secure sign-in cookie. A session lasts up to 7 days; using it does not extend that period. You can sign out of the current browser or all browsers from your account. Signing out ends those sessions, but does not delete your account, verified email or purchase history. Only your language choice is saved in browser session storage. Email, codes, payment status and documents are not saved there.

Expiry and deletion

A sign-in code is valid for 5 minutes and can be used once. Expiry prevents further use; it does not mean immediate physical deletion. Expired code and session records and short-term abuse-prevention records are cleaned up during later sign-in service use. Counts of code send attempts cover 24-hour and 31-day periods starting with the first counted attempt, including failed sends.

Your verified account details and purchase and recovery references remain after codes or sessions expire and after sign-out. Protected backups of account and payment records can retain older data. Recovery from a backup invalidates old sessions and codes, requires payment checks and can lose newer records. Account deletion is not automatic, and no fixed deletion time is promised. For deletion questions and other privacy requests, use the contact below.

Recovering access, not files

A fresh code sent to the same mailbox recovers the same account. Any pass still depends on its current payment and expiry status; signing in does not extend it. You need continued access to that mailbox, and recovery without it is not promised. Sign-in and payment recovery cannot restore local files or downloads. Download completed copies before clearing, signing out, reloading or leaving the preparation page.

Payment data where enabled

Payment details are entered on Stripe’s checkout page and processed by Stripe. Cloakfold retains purchase and payment references linked to your account, their status, and records needed to check payments, recover access and avoid duplicate purchases. For the browser pass, Cloakfold sends neither documents nor your sign-in email to Stripe. For new MCP orders, Stripe collects billing details and Cloakfold retains the completed checkout details as described above. Historical MCP orders keep their original billing arrangements. Stripe handles checkout information under its privacy policy.

For browser orders, Cloakfold also retains the full terms and their version, your declared country, purchase purpose and tax case, the dated order acknowledgment, your separate agreements to the terms and immediate performance, and the verified email address fixed for the contract confirmation. Stripe receives the country, purpose and tax case, terms references and evidence of those agreements to check and recover payments. Those references are pseudonymous, not anonymous. They contain neither your sign-in email nor the full terms. Cloudflare processes the confirmation recipient and the full, unencrypted confirmation message.

New browser purchases receive original Stripe invoices, with invoice and receipt download links sent to the billing email held or collected by Stripe Checkout. Stripe holds those invoice and billing details; Cloakfold does not copy them into its account records. Historical orders keep their original invoice arrangements.

The exact confirmation files and records of sending attempts and access provision remain with private account and payment records and their backups after expiry or sign-out. They are not promised to be deleted after 30 days. Acceptance by an email provider does not prove that a message reached your mailbox. Offering a download does not prove that you saved it or received legally effective delivery. Lost history can prevent recovery of the exact original. Reconstructed copies are labeled and are not automatically emailed again.