Privacy Policy

Effective date: October 28, 2026
Last updated: October 28, 2026

This Privacy Policy explains how Caspers Cloak LLC ("Casper's Cloak", "we", "us", or "our") collects, uses, and protects information when you use the Casper's Cloak iOS app, Mac app, Android app, and website at casperscloak.com (together, the "Service").

We built Casper's Cloak as a privacy product. The whole point is to give you a tool that does not log, track, or sell what you do online. This policy is written to be specific and verifiable, not to give us wiggle room.

1. Quick summary

We do not log or track your online activity in a way that ties to your account. We do not keep logs of the websites you visit, the apps you use, the destinations of your traffic, or the contents of your traffic.
We do not sell your data. Ever. We do not share it with advertisers, data brokers, or third-party analytics platforms.
We collect the minimum we need to run the Service: an email address to log you in, a device identifier so the right device receives push notifications, and a record that you have an active subscription if you purchase one. We also keep basic connection records — such as when you connect and to which of our servers — that we need to run and recover your VPN sessions and enforce your plan's data cap. These records never include the sites, apps, or content of your traffic.
Private Health Check's results stay on your phone, and you can delete them in the app. It runs only when you start it. To check whether your system is up to date, the app sends only your system version and device model (iPhone and iPad) or your security patch date and Android version, plus the app's language, to our server, and it does so without your account. We do record with your account that you ran a checkup and how many issues it found, but never what those issues were (Section 3.4).
Messages. Every account with a monthly data cap gets our data-cap notices, and every free trial started on our website gets the messages about its dates, price and end. Summary emails, reminders and trial tips are marketing, and we send them only if you have said yes. You can change your mind at any time (Section 5A).
You can delete your account and all associated data at any time by following the steps in Section 9.
For purchases, we use Apple, Google, or Stripe as the payment processor. We do not see or store your full card number.

2. Who we are

Casper's Cloak is operated by Caspers Cloak LLC, a Florida limited liability company.

Mailing address: 1343 Main St, Ste 705, Sarasota, FL 34236-5630, USA Contact: support@casperscloak.com

For privacy-specific inquiries (including GDPR / CCPA requests), please use the same address with "Privacy" in the subject line, or email support@casperscloak.com.

3. What information we collect

We collect only what we need to operate the Service. Below is an exhaustive list.

3.1 Information you provide

Email address. Required to create an account. We send a one-time login code to this address. We do not require a password.
Payment information (only if you subscribe). When you purchase a subscription:
- Through the iOS or Mac app: Apple processes the payment. We receive a confirmation that you have an active subscription tier; we do not receive your card number, billing address, or Apple ID.
- Through the Android app: Google processes the payment via Google Play Billing. We receive a purchase token and tier confirmation; we do not receive your card number.
- Through casperscloak.com: Stripe processes the payment. We receive a customer reference and tier confirmation. Stripe handles your card details directly under their privacy policy. We do not store full card numbers.
Support correspondence. If you email us, we keep the email so we can answer it.
Your marketing choice. Whether you have said yes to marketing messages, and any later change you make to that choice or to your notification settings (Section 5A).

3.2 Information we receive automatically

Device identifier. An identifier for each device you use Casper's Cloak on, used so we can deliver push notifications to the right device and so the VPN service can identify itself to our control plane. On iPhone and iPad, it is the identifier Apple assigns to our apps on that device (Apple's "identifier for vendor"). On the Mac, from version 1.3.62, it is a random identifier the app creates. Earlier versions of the Mac app made it from an encoded copy of the Mac's serial number; updating to version 1.3.62 replaces it with a random one. On Android, it is a random identifier the app creates. It is never your advertising identifier (no IDFA, no Android advertising ID), and we don't use your IMEI or your network (MAC) address.
Device name. When you sign in, the app sends your device's name and, on iPhone, iPad and Mac, whether it is a phone, tablet or computer and which system it runs. On the Mac, the name is the computer name set in your Mac's settings (for example, "Jane's MacBook Air"). On iPhone and iPad, Apple gives the app only a general name such as "iPhone" (on iOS 15, the name you gave the device). On Android, it is the maker and model (for example, "Google Pixel 8"). We keep it with your account, replaced each time you sign in on that device, so we can tell your devices apart when we run your account and answer your support requests.
Push notification token. Issued by Apple Push Notification service (iOS) or Firebase Cloud Messaging (Android). We send this to Apple/Google when we deliver a push to your device.
Subscription tier and status. Whether you are in a free trial, on a paid plan (and which one), or have no active plan, and whether your account kept our former free plan (see the Terms of Service, Section 5).
Last activity time. The last time your app checked in with our servers or started a VPN connection. It is a single time, replaced each time, not a history. We use it to keep your account working and, only if you said yes to marketing, to send the reminders described in Section 5A.
Record of messages sent. For each data-cap notice, summary email or reminder we send you: which message it was, whether it went by email or notification, the period it was for, and the notification text or email subject. For the free trial messages and trial tips in Section 5A: which message it was, whether it goes by email or notification, when it is due, and whether it was sent. We keep this so that we send each message once, at the right time, and don't send you the same message twice.
Connection session records. When you connect, we keep a record tied to your account of which server and circuit you used, your device identifier and its VPN public key, the internal VPN IP we assign you, the connect and disconnect times, and how much data was transferred. We use this to operate the VPN (assign, monitor, and recover your connection, apply your kill switch, and enforce your data cap), to keep your account secure, and to prevent fraud and abuse. It never includes the websites, apps, destinations, or contents of your traffic (see Section 3.3), and it is deleted when you delete your account (see Sections 7 and 9).
Location for choosing a server. Each time you connect, we look up an approximate location (city level) from your IP address to pick a nearby server. If you turn on Precise Location in the iPhone or iPad app, the app sends your device's location instead. The Android app never sends your device's location, and neither does the Mac app from version 1.3.62; earlier versions of the Mac app send it if you have allowed the app to use your location. We use it only to choose a server at that moment: we don't store it with your account and we don't keep a history of it.
Tor exit country (Tor realms only). If you connect through one of our Tor realms (Section 4) and pick an exit country, we store that country, and the country actually used if we had to substitute a nearby one, on the record of your current connection. We need it to route your traffic and to resume a dropped connection. It stays there only while the connection is active, or for up to 24 hours while we hold a dropped connection so it can resume, and is erased from the record within a few minutes after that. We don't keep a history of the countries you have picked. We also count, per day, how many connections used each country; those counts are not linked to any account, device or IP address. Your pick is also saved in the app's settings on your device, so the app remembers it, until you change it or delete the app.
In-app usage events. The app sends us a small number of events, tied to your account, so we can see where people get stuck and which features they use. These are the steps in the subscription screen (for example, that it was shown, which plan you tapped, whether the purchase went through, was cancelled or failed, and the error message if one was reported) and the Private Health Check events listed in Section 3.4. Each event also records your device identifier and the app version (and, for the iPhone and Mac apps, which of the two sent it). These events never include the websites you visit, the names of Wi-Fi networks, the apps on your phone, or what a checkup found.
Operational telemetry. Aggregate metrics that are not tied to your account: total active sessions per server region, total bytes transferred per region, error rates. This data cannot be used to identify any individual user.

3.3 Information we explicitly do NOT collect

We want to be specific about this:

We do not log the websites or services you visit through the VPN.
We do not log the IP addresses you connect to through the VPN.
We do not log the contents of your traffic.
We do not log DNS queries you make through the VPN, beyond the in-memory check needed to apply our threat blocklist on your behalf. Those checks are not written to disk and are not associated with your account.
We do not tie the sites you visit, the apps you use, or the contents of your traffic to your account. We do keep basic connection metadata — that you connected, when, and to which of our servers — as described in Section 3.2; this shows only that you used the VPN, never what you did through it.
We do not store your originating IP address (the address your internet provider gives you) against your account. When you connect, we use it at that moment to choose a nearby server (Section 3.2). It also appears in the standard access logs of our website and of the servers the apps talk to, which are deleted within 30 days (Section 7). While you are signed in on casperscloak.com, your website session also holds it; expired sessions are deleted.
We do not use third-party analytics SDKs in the iOS or Android apps. There is no Google Analytics, no Firebase Analytics, no Mixpanel, no Amplitude, no Segment, no Crashlytics, no Sentry SDK in the apps.
We do not embed advertising SDKs.

3.4 Private Health Check (iPhone, iPad and Android)

Private Health Check is an optional check. It runs only when you start it in the app, and never runs on its own. It is available in the iPhone and iPad app on iOS 15 or later and in the Android app. The Mac app does not have it. It looks at settings on your phone and shows you what to fix.

What it checks, on your phone. It checks:

whether a passcode, and Face ID, Touch ID or fingerprint unlock, are set up;
signs that the phone has been jailbroken or rooted;
your system version and, on Android, your security patch date;
the security type of the Wi-Fi network you are connected to (for example, whether it is open or uses WPA3);
whether a proxy or private DNS is set;
on Android, whether USB debugging is on and whether the phone is encrypted;
a list of recommended security and privacy settings that apps cannot read. You confirm these yourself in the Fix-it steps, and which ones you have marked as done is saved only on your phone.

It also shows which Casper's Cloak protections are turned on. Private Health Check does not ask for your location to read the Wi-Fi security type.

What stays on your phone. Private Health Check works out its results on your phone and saves them only in the app on that phone. We do not receive them. That includes the Wi-Fi network's name and security type, and every other finding. If you choose Remind me later for the Fix-it steps, the reminder (in 24 hours, or at a date and time you pick) is a notification scheduled on your phone; nothing about it is sent to us. You can delete your results at any time with the Delete health check history option in the app (Delete checkup history on Android), which clears the saved results, their history, the settings you marked as done, your progress through the Fix-it steps and any reminder you set.

What the app sends to check your system version. To tell whether your system is current, and which known security problems newer versions fix, the app gets reference information from our server at uncloakedbycasper.com. We, Caspers Cloak LLC, also run that server for our Uncloaked app. These requests:

send, on iPhone and iPad, your iOS or iPadOS version and the device's model code (for example, "iPhone15,2"); on Android, your security patch date and Android version; on an iPad, the fact that it is an iPad, so that it gets the iPad list of recommended settings; and the app's language, so that list comes in your language;
do not include your email, your account or your device identifier, and are not linked to your Casper's Cloak account;
like any request on the internet, carry your IP address and a basic description of the app and system making the request (the "user agent").

The list of the newest system versions is downloaded in full, and your phone looks up its own model in it. That server's standard web logs record each request, with the details above, your IP address and the user agent. We use these logs only to run and secure that server, and we delete them after 14 days.

What we record with your account. When you use Private Health Check, the app sends us these in-app usage events (Section 3.2), tied to your account:

that you started a checkup;
that it finished, with its overall result ("Looks good", "Needs attention" or "Needs attention now") and the number of issues;
that you started the Fix-it steps;
that you finished them, with how many steps you completed and how many you skipped;
if you turn on a Casper's Cloak protection from the checkup, which protection it was, or that you connected from it.

These events contain only the result, the counts and the protection's name listed above. Setting a Fix-it reminder records no event. They never include what the issues were, Wi-Fi network names, or the apps on your phone.

What Private Health Check does not do. It does not check your email address against data breaches. It does not list or scan the apps on your phone. It does not scan the other devices on your local network.

4. How the Service works (and why this matters for your privacy)

A VPN that processes your traffic could in theory see everything. We engineered ours so that we cannot.

Tunnel architecture. The VPN tunnel is built on the WireGuard protocol. Your device negotiates an encrypted tunnel directly with the VPN server. Our control plane does not sit between you and your destination once the tunnel is up.
Threat detection. Casper's Cloak applies a domain-level blocklist (more than 100,000 domains associated with malware, phishing, ad-tracking, and surveillance) against DNS lookups made through the tunnel. The matching happens against a list and is not logged or transmitted off-device in association with your account.
Decoy traffic. Casper's Cloak generates cover traffic alongside your real traffic to make timing- and volume-based traffic analysis less effective. The decoy traffic is generated locally; we do not log which streams are decoy versus real.
Tor realms (The Shallows and Eternal Darkness). If you choose a Tor realm, your traffic goes from our VPN server through the Tor network, and websites see the address of a Tor exit relay instead of our server's. Tor relays are run by independent volunteers, not by us. The exit relay can see which site you are connecting to, and the content of any traffic that is not itself encrypted (for example, a website that does not use HTTPS). If you pick an exit country, your traffic leaves the Tor network only in that country. If that country is not available when you connect, we use the nearest available country in the same realm, and the app shows which country is being used. Tor connections are usually slower than our standard servers.
No logs server policy. Our VPN servers are configured not to write per-session activity logs to disk. Our control plane (account, subscription, push) has separate logs that contain only the operational events listed in Section 3.2.

This section is an honest description of what the Service does. If we change the architecture, we will update this section and notify users.

5. How we use information

We use information only for:

Running the Service (delivering the VPN, choosing a nearby server when you connect, sending login codes, applying threat protection on your behalf).
Maintaining your account and subscription.
Communicating with you about service-critical matters (security incidents, planned downtime, major changes to this policy or the Terms of Service), and sending the service messages described in Section 5A.
Sending you marketing messages, only if you have said yes (Section 5A).
Responding to your support requests.
Understanding how the app's screens and features are used, through the in-app usage events in Section 3.2, so we can fix problems and improve the Service.
Detecting and preventing fraud, abuse, and security threats against the Service itself.
Cooperating with Apple or Google to evaluate a refund that you request.
Complying with our legal obligations.

We do not use your information for advertising, profiling, automated decision-making with legal effect, or to train AI/ML models that are then sold or shared externally.

5A. Messages we send you

Service messages

These are part of the Service, and we send them to every account they apply to, whatever your marketing choice:

Sign-in codes, and messages about your payments or subscription.
Free trial messages. If you start a free trial on casperscloak.com, we send: a welcome email that tells you what happens when the trial ends; a notification when you are halfway through the trial; an email the day before it ends and a notification 4 hours before it ends, each saying which plan starts, and at what price, unless you cancel; and then either your receipt, if your subscription starts, or a notification that your trial has ended and Casper is disconnected, and that you can choose a plan to reconnect.
Data-cap notices. If your plan has a monthly data cap, we let you know when you have used 75% and 90% of it, and when you have reached it. At 75% and at the cap we send an email and a notification; at 90%, a notification only. You receive notifications only if you allow them on your device. You can turn off the 75% and 90% heads-ups under Notifications in the app's menu (iPhone and Android). The notice that you have reached your cap is always sent, because from then until the cap resets your connection runs at reduced speed.

Marketing messages (only if you say yes)

A summary email one week after your first VPN connection, and a monthly recap email.
Reminder notifications if you haven't used Casper's Cloak for 14, 30 or 60 days.
Trial tips. During a free trial started on casperscloak.com, two notifications about what Pro does: "Pro is on for 7 days" when the trial starts, and "Pro is working in the background" the next day.

We send these only to people who have said yes, either by ticking the box when they create an account, where the sign-up screen offers it, or later under Notifications in the app's menu. If we have no record that you said yes, you don't get them.

You can stop them at any time: turn them off under Notifications in the app's menu, where the trial tips have their own switch, or use the unsubscribe link in any marketing email. You don't need to sign in to unsubscribe. You can also turn off notifications for Casper's Cloak in your device's settings. Saying no or stopping has no effect on your subscription or on the service messages above.

6. Who we share information with

We share information only with the following categories of recipients, and only as needed:

Recipient	Purpose	Data shared
Apple	iOS and Mac app distribution; Apple ID login (if used); IAP processing	Apple's standard transaction data — they do not share your Apple ID with us
Google	Android app distribution; Google Play Billing	Google's standard transaction data
Stripe	Payment processing for web subscriptions	Email + your card details (provided by you to Stripe directly)
Apple Push Notification service	Delivering iOS push notifications	Push token + the notification body
Firebase Cloud Messaging (Google)	Delivering Android push notifications	Push token + the notification body
Legal authorities	Only when required by valid legal process (subpoena, court order). We will challenge over-broad requests.	Only what is responsive to the specific request

We do not sell or rent your information to third parties under any circumstances. We do not share your information with advertisers or data brokers.

Refund reviews. If for some reason you request a refund for an in-app (Apple) or Google Play purchase, we may share information about your account's subscription and service usage — such as how long and how often you connected, and your purchase and refund history — with Apple or Google to help them evaluate the request. We do this only in response to a refund you initiated, and only with the platform that processed your purchase.

If we are ever required to disclose information by law, we will notify the affected user before disclosure unless legally prohibited from doing so.

7. Data retention

Account information (email, device identifier, device name, subscription tier, last activity time, your marketing choice and notification settings, and the record of messages sent): kept for as long as your account is active. Deleted within 30 days of account deletion, except where we are required by law to retain billing records (typically 7 years for tax purposes — only the financial transaction record is retained, not your activity).
Connection session records (the metadata in Section 3.2 — the server and circuit you used, your device identifier and VPN public key, the internal VPN IP assigned to you, connect and disconnect times, and data volume): retained while your account is active so we can operate, monitor, and recover your connections and enforce your data cap. They contain no browsing or traffic activity, are never sold, and are shared only as described in Section 6 (including a refund review you initiate). They are deleted within 30 days of account deletion.
Tor exit country (Section 3.2): erased from the connection record within a few minutes after the connection ends, or after it has been held for up to 24 hours so a dropped connection can resume. Saved in the app's settings on your device until you change it or delete the app. The daily per-country counts are aggregate operational telemetry (below).
In-app usage events (Section 3.2): deleted 180 days after they are recorded, or within 30 days of account deletion if that comes first.
Private Health Check requests to uncloakedbycasper.com (Section 3.4): kept in that server's web logs and deleted after 14 days. Private Health Check's results are kept only in the app on your phone, until you delete them with Delete health check history (Delete checkup history on Android) or delete the app.
Push tokens: invalidated and removed when you uninstall the app or delete your account.
Support correspondence: kept for 2 years from last contact, then deleted, unless an ongoing matter requires longer retention.
Location for choosing a server (Section 3.2): not kept. It is used only while we choose your server.
Transient web-server access logs (containing your originating IP, for casperscloak.com and for the servers the apps talk to): rotated and deleted within 30 days.
Control-plane operational logs (Section 4): deleted after 30 days. They don't contain your originating IP address, your location or your email address.
Aggregate operational telemetry: kept indefinitely in anonymized form.

8. Security

We use industry-standard measures to protect your data, including:

TLS (HTTPS) for all communication between your device and our servers.
WireGuard cryptography for the VPN tunnel itself.
Encryption at rest for our databases.
Restricted internal access on a need-to-know basis with audited logging.
Regular security review of our infrastructure and dependencies.

No system is perfectly secure. If we ever experience a data breach affecting your information, we will notify you in accordance with applicable law and post a public notice at casperscloak.com/security.

9. Your rights and how to exercise them

9.1 Account deletion

You can delete your account and all associated data:

In the app: on iPhone and iPad, tap the menu button (☰) on the home screen, then Delete Account, then Continue; on the Mac, click the menu button (☰) at the top of the window, then Delete Account, then Continue (in earlier versions of the Mac app, click the settings button (gear), then Delete Account under Advanced Settings). Both open the deletion page on casperscloak.com in your browser, already signed in. On Android, tap the menu button (☰), then Delete Account; it opens our account-deletion page (casperscloak.com/account-deletion), where you finish on the web or by email.
On the web: Sign in to casperscloak.com, go to casperscloak.com/account/delete, and confirm by typing the email address on your account. The steps for every option are on casperscloak.com/account-deletion.
By email: Email support@casperscloak.com from the email address on your account, with the subject line "Delete my account". We will confirm deletion within 14 days.

When you delete your account, we delete all data described in Section 3 within 30 days, except for the limited categories noted in Section 7 that we are legally required to retain.

9.2 GDPR rights (European Economic Area, United Kingdom, Switzerland)

If you are in the EEA, UK, or Switzerland, you have the right to:

Access the personal data we hold about you;
Rectify inaccurate personal data;
Erase your personal data ("right to be forgotten");
Restrict or object to processing;
Portability — receive your data in a machine-readable format;
Withdraw consent at any time where processing is based on consent;
Lodge a complaint with your local supervisory authority.

The legal bases on which we process personal data are:

Contract (Article 6(1)(b) GDPR): to deliver the Service you have signed up for.
Legitimate interests (Article 6(1)(f) GDPR): to keep the Service secure, prevent fraud, operate aggregate analytics, and understand how the app's features are used (the in-app usage events in Section 3.2).
Legal obligation (Article 6(1)(c) GDPR): to comply with tax, accounting, and law-enforcement obligations.
Consent (Article 6(1)(a) GDPR): for marketing messages (Section 5A), and for any other optional features that explicitly ask for consent. You can withdraw it at any time, as described in Section 5A.

To exercise any of these rights, email support@casperscloak.com.

9.3 CCPA / CPRA rights (California residents)

California residents have the right to:

Know what personal information we collect, use, disclose, and (if applicable) sell or share — this Privacy Policy provides that disclosure.
Delete the personal information we have collected — see Section 9.1.
Correct inaccurate personal information.
Opt out of sale or sharing of personal information. We do not sell or share your personal information as those terms are defined under the CCPA/CPRA, so there is nothing to opt out of.
Limit use of sensitive personal information. We do not use sensitive personal information for any purpose other than the operation of the Service.
Non-discrimination for exercising your rights.

To exercise any of these rights, email support@casperscloak.com. We will verify your identity (typically by sending a confirmation to the email on file) and respond within 45 days.

9.4 Other US states

If you are a resident of a US state with comprehensive privacy legislation (Virginia, Colorado, Connecticut, Utah, Texas, and others as enacted), you have substantively similar rights to those described in 9.3. The same contact path applies.

10. Children

The Service is not directed to children under 13 (or under 16 in the EEA / UK). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact support@casperscloak.com and we will delete it.

11. International transfers

Casper's Cloak is operated from the United States. If you use the Service from outside the United States, your information is transferred to and processed in the United States, which may have different data protection laws than your country.

For transfers from the EEA, UK, or Switzerland, we rely on the Standard Contractual Clauses approved by the European Commission and supplementary measures as required by applicable law. A copy of the SCCs is available on request to support@casperscloak.com.

12. Third-party services and links

The Service may link to third-party websites, services, or apps that are not operated by us. This Privacy Policy does not apply to those third-party services. We are not responsible for their content or privacy practices.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we do:

We will post the updated policy at casperscloak.com/privacy-policy.
We will update the "Last updated" date at the top of this page.
For material changes (changes that meaningfully reduce your privacy or expand our use of your data), we will notify you by email at least 30 days before the change takes effect, and where required by law, ask for your renewed consent.

14. Contact us

For any question, request, or concern relating to this Privacy Policy:

Email: support@casperscloak.com Postal: Caspers Cloak LLC, 1343 Main St, Ste 705, Sarasota, FL 34236-5630, USA

Changes to this page

October 28, 2026: added how we use your location to choose a server (Section 3.2): an approximate, city-level location looked up from your IP address, or your device's location if you turn on Precise Location in the iPhone or iPad app (the Android app never sends it, and the Mac app doesn't from version 1.3.62; earlier Mac versions send it if you have allowed location access), used only at the moment you connect, not stored with your account or kept as a history. Section 3.2 now says which device identifier each app uses: on iPhone and iPad, the identifier Apple assigns to our apps; on the Mac, a random identifier from version 1.3.62, and before that one made from the Mac's serial number; on Android, a random identifier. It had said that every app used a random identifier not derived from your hardware. Section 3.2 now also lists the device name the app sends when you sign in, and Section 7 says how long it is kept. Section 9.1 now gives the current steps to delete your account from the Mac app. Section 3.3 now says where your originating IP address does appear (server choice at connect time, our access logs, your website session). Section 7 now gives retention for control-plane operational logs (30 days, without your originating IP address, location or email address) and covers the access logs of the servers the apps talk to. The previous version took effect on October 16, 2026 and was last updated on October 16, 2026.
October 16, 2026 (correction): Section 9.1 now gives the real steps to delete your account from each app (iPhone and iPad, Mac, Android) and on the web. It had said that deleting from the app was still to come, and pointed to a web option and a no-sign-in form that work differently. This change does not reduce your privacy or expand our use of your data, so the effective date is unchanged.
October 16, 2026 (third update that day): added Section 5A, which sets out the messages we send. Data-cap notices go to every account with a data cap, and at the cap the connection continues at reduced speed until the cap resets; the messages about a website free trial's dates, price and end go to every trial; the summary emails, inactivity reminders and trial tips are marketing and go only to people who have said yes; it also explains how to stop them. Section 3 now lists your marketing choice, your last activity time and the record of messages sent. The plan status in Section 3.2 now reflects that there is no free plan. The page now also names the Mac app, which it had left out. The previous version took effect on October 16, 2026 and was last updated on October 16, 2026.
October 16, 2026 (later the same day): added the Tor exit country (Section 3.2): what we store when you pick an exit country in a Tor realm, that it is erased within a few minutes after the connection ends (or after a dropped connection has been held for up to 24 hours), and that the daily per-country counts are not linked to anyone; its retention (Section 7); and how Tor realms work, including what Tor exit relays can see and the nearest-country fallback (Section 4). This change does not reduce your privacy or expand our use of your data, so the effective date is unchanged.
October 16, 2026: added Private Health Check (Section 3.4): what it checks on your phone, that it runs only when you start it, how to delete your results in the app, that Fix-it reminders are scheduled on your phone, the system-version lookup it sends to uncloakedbycasper.com and how long those logs are kept, and the checkup events we record with your account. Added in-app usage events (Section 3.2), including the subscription-screen events the apps have sent since October 1, 2026, with their purpose (Section 5), legal basis (Section 9.2) and 180-day retention (Section 7). The first point of the Quick summary now says "online activity", because these in-app events are tied to your account.