Privacy Policy

Last updated: August 2026. Applies to the CloakDLP browser extension and desktop application.

In one sentence: CloakDLP runs entirely on your own computer, has no server of its own anywhere, and the full card number you type never leaves your browser under any circumstances.

What the extension reads

The extension's content script watches text-like form fields on the pages you visit for a Luhn-valid credit card number as you type. This requires the extension to be able to run on any website, since a checkout form can appear on any domain, not a fixed list known in advance. That's why it requests broad host permissions.

Reading is not the same as sending. The content script only ever acts on what it reads locally, inside your own browser.

What actually gets sent, and to where

When a match is found, exactly three things are sent, and nowhere except your own machine:

The card number redacted to its last 4 digits (e.g. ************4242). The full number is discarded immediately after the redaction happens, in memory, before anything is sent anywhere.
The domain of the page you were on.
A confidence score and an internal rule identifier, used only to display the match in your own console.

All of it goes to http://127.0.0.1:8123, a web console that CloakDLP installs and runs locally on your own PC. That address only resolves to the computer the extension is running on. There is no CloakDLP-operated server anywhere, and no third party ever receives this data, because there is nowhere else for it to go.

What CloakDLP does not do

Never transmits, stores, or has access to a full, unredacted card number.
No analytics, no advertising, no tracking of your browsing beyond the local detection described above.
No account, no sign-in, no cloud sync.
Nothing is ever sold, shared, or shown to anyone but you.

Outbound network requests the desktop console makes

The local console (not the extension itself) makes two kinds of outbound calls, both for a domain risk score shown next to a match, and both are simple lookups, not data uploads:

A check against the URLhaus malware/phishing hostname blocklist (free, no account, no API key).
A standard WHOIS lookup for the destination domain's registration age.

Neither of these ever includes any card data, redacted or otherwise, only the destination domain name.

Data retention and deletion

Everything CloakDLP records lives in a database file on your own machine, under your own control. You can delete an incident, delete the whole database, or uninstall CloakDLP entirely at any time; nothing persists anywhere else once you do.

Open source

Every claim on this page is independently verifiable: CloakDLP is fully open source under the MIT license. The extension's source is at browser-extension/ and the full project at github.com/MAXIVA11/CloakDLP.

Questions

Open an issue at github.com/MAXIVA11/CloakDLP/issues.