kloak.app repeats one sentence until it sounds like a design document: privacy isn’t a feature, it’s the architecture. Open the accordion answers in the shipped JavaScript. The architecture is a username, a SHA-256 of a secret, and a message store the operator can read.
Said on the homepage, the About page, the privacy policy, the cookie policy, and the terms. Join Us: “Privacy is not a feature here. It is the architecture. Every decision starts with what the server should never see.”
Found in the FAQ, “Is my data encrypted?”: secret keys are hashed with SHA-256. Traffic is HTTPS. “We are currently working toward implementing end-to-end encryption for messages.” About puts a timeline of “six months or 2 years” on zero-knowledge. A founder already wrote, inside the app, that messages are readable at the database. Architecture that the server can read is a feature list with a nicer noun.
About · FAQ · Privacy file
Said on the homepage: “without phone numbers, emails, ads, or behavioral tracking.” Cookie policy: no analytics cookies, no advertising cookies, no social pixels, no third-party trackers, no device fingerprinting. FAQ: “we also collect zero analytics, tracking pixels, or behavioral data.”
Found in production index.html: hCaptcha is on the registration path and in the CSP. hCaptcha’s job is to tell bots from humans. It does that with device and behavior signals. Cloudflare sits in front of the whole site. Google Fonts are loaded from fonts.googleapis.com. Cookie policy still claims “no consent banner is legally required” because only “strictly necessary cookies” exist. They also store the secret key in Local Storage and call that a cookie.
Said in the cookie policy, in the paragraph about social pixels and third-party trackers.
Found in the live CSP connect-src / frame-src / font-src:
foquucurnwpqcvgqukpz.supabase.co (named in the FAQ)kloak-ws.fly.dev)FAQ: “Kloak uses Supabase as its backend infrastructure. AWS EU West.” Join Us lists the same stack. A hosted database is a vendor. The problem in this section is the in-house line. Signal Protocol, Sender Keys, and libsodium are still “on the horizon” in the job posts.
Said in the FAQ: “Because Kloak collects zero personal data, no email addresses, no phone numbers, no IP logs, no analytics, and no tracking of any kind, GDPR’s scope of application to Kloak is extremely limited.” Privacy policy: they never collect “physical location or IP logging, device fingerprints.”
Found in the same FAQ: username, key hash, messages, profile, membership. Usernames and message content are personal data when they can identify someone. Cloudflare and hCaptcha see IP addresses whether Kloak stores those addresses or not. The privacy policy still offers GDPR-shaped rights (access, correction, deletion, export) in the next accordion. You do not write an export clause for data you do not have.
Said on Join Us: “passionate volunteers building tools where the server never sees your content.” Older landing copy, quoted on Hacker News: “You own your community data.”
Found, founder message quoted on HN from inside the app:
Messages are stored on our servers and are technically accessible at the database level, we won't pretend otherwise. … Our goal is to implement end-to-end encryption for DMs so that even we can't read message content. But we're not there yet, since after all we need to make sure the platform is safe and not to shield illegal content being sent.
That is the honest sentence. The Join page is the brochure.
Said on About: “In January 2026, we quietly opened the doors to a very, very early alpha… No promotion. No marketing campaigns. No launch events. … We did not want attention.”
Found: Show HN by lakshikag, “two of us have been working on a privacy-focused Discord alternative.” Official YouTube channel with a promo video and feature explainers. Posts on r/discordsucks and r/kloakapp. AlternativeTo listing. YouTube tags on the promo include “discord alternative with free nitro features.” The first HN comment on the Show HN was that /faq was 404, and that pricing was “hidden better than any other site.”
Said on About: “No subscriptions. No ads. No data harvesting.” FAQ: “Using Kloak is and will always be free,” with optional paid upgrades later for storage and other QoL. YouTube pinned comment: if paid features arrive, they will be things like higher-resolution screen sharing.
Found on buymeacoffee.com/kloak: Lite $5/month, Core $15/month, Titan $45/month. Paid members get roles and badges on the community server. Titan includes “Lifetime of free, paid features, as long as you’re a member.” That is a subscription that pre-sells the paid tier the FAQ still describes as hypothetical.
Said in the live FAQ, twice: “Not yet. Kloak is currently available through your web browser.” Same answer for mobile and desktop.
Found on the homepage: a Google Play badge, plus App Store / Windows / Linux marked “Soon.” Play Store listing app.kloak.mobile, developer Hedge Studio Labs, updated 4 August 2026, 500+ downloads. A staff account on Reddit told r/kloakapp in February 2026 they were “aiming to launch the Windows app by the end of this month.” The FAQ was not updated to match any of that.
Said in the FAQ: “Kloak is currently a community project without a registered legal entity.” Terms: “Kloak is not a company, and we have never presented ourselves as one. … We don’t generate revenue and we don’t operate under any jurisdiction as a company.” They also say they cannot make guarantees about uptime or data integrity “because there’s no entity capable of making those guarantees.”
Found on Google Play: a developer name (Hedge Studio Labs), a person (Lakshika Gayal), a country (Sri Lanka), a support email, and a Data safety form filed as a store developer. Donations go through Buy Me a Coffee. Recurring memberships generate revenue. Child-safety copy cites Google Play’s Child Safety Standards. You do not file Play Store forms from a legal vacuum. You file them as a developer who wants Android users.
Said on the official YouTube FAQ comment, 5 February 2026: “Open sourcing is definitely something we’re considering. … Before releasing anything publicly, we want to clean up the codebase, make it more readable, and properly document it.” HN, same era: “For now, yes” it is closed source. A later YouTube comment: “Open source is coming soon once the code has been cleaned and stabilised.”
Found in September 2026: still proprietary. AlternativeTo: “Licensing Proprietary and Free product.” Privacy Guides: people told the original poster to use Matrix because Kloak is closed source and not E2EE. “Coming soon” is the whole transparency model.
Said on the official Android listing Data safety section: “No data shared with third parties.” “No data collected.”
Found in Kloak’s own FAQ: they collect username, key hash, messages, profile, membership. Registration sends an hCaptcha response to a registration URL. That form is a store listing, not a description of the app.
Said on About: “maintained by a team of roughly five people, all working on this as a side project alongside our day jobs.” Show HN: “two of us have been working on” it. Join Us: 8 engineering + 6 design + 4 security + 5 community positions, plus “Don’t see your role listed?”
Found: the Join page is a hiring board for a product that, in the terms, is a volunteer passion project with no entity. Engineering roles ask for “Comfort working with AI-assisted development tools such as Cursor, Lovable, Claude, or GitHub Copilot.” The encryption engineer is hired to build the layer the homepage already speaks in the present tense.
On the Discord-alternatives HN thread, a commenter asked: “Why would they name their software sewer?” In Danish, Norwegian, and Swedish, kloak is the sewer. Dutch too. The domain still works. The joke writes itself in three languages they did not check.