Privacy Policy — Lex Cloak

Lex Cloak processes all documents on your device. Your files never leave it. The main personal information we receive is what Paddle (our payment processor) provides when you subscribe: your email address and subscription status. To run licensing, we also receive a device identifier, your operating system, and the app version when your subscription is checked. If you use Lex Cloak without subscribing, nothing about your documents is sent anywhere. The app does send a short note at three points during the free trial: the first time it opens, the first time you export a document, and the point where the free exports run out. Each note carries a random identifier that is not linked to you, your device, or any subscription, plus the app version, and nothing else. See The Free Trial for the full detail. Separately, while the app is running it checks whether a newer version has been published. That check carries no identifier and nothing about your documents. See Checking for Updates.

Lex Cloak processes documents locally on your device. Scanning, detection, and redaction run entirely on your machine. Your files are never uploaded and are not accessible to any third party.

While you are editing, working state lives in a temporary folder managed by your operating system, and Lex Cloak saves your choices to a small file next to the original document. Neither is ever transmitted off your device.

When you download the redacted copy, Lex Cloak deletes that file and the working state, because the download finalizes the document. Lex Cloak does not maintain a central sessions folder. See About Your Working Session below for the technical detail.

Lex Cloak's editing model is local-first: every document you open is processed on your machine and the working state is managed transparently.

While you are editing a document, Lex Cloak stores the working state (your match keep/exclude choices, manual redaction regions, page rotations, and OCR cache) in a temporary folder provided by your operating system. On macOS this is typically /var/folders/.../T/lexcloak-active/. On Windows it is %TEMP%\lexcloak-active\. On Linux it is $XDG_RUNTIME_DIR/lexcloak-active/ or /tmp/lexcloak-active/. A document's working state is removed when you download its redacted copy or discard its work, and when you close the application with nothing left to finish on it. Work you have not finished stays there until you finish or discard it. If Lex Cloak closes unexpectedly, the folder may persist until the operating system reaps it or until you discard the recovery offer on next launch.

While you work, Lex Cloak also saves your choices to a small file next to the original document, named temp-meta-data_ followed by the document's name, with a .lexcloak extension. It records where each redaction goes and what you decided (match decisions, manual regions, rotations), not the text of your document, and it references your original by path and content hash. It is how Lex Cloak offers your work back after the application closes, even once the operating system has emptied its temporary folder. When you download the redacted copy, Lex Cloak deletes this file. Lex Cloak does not maintain a central sessions folder.

Lex Cloak keeps two small lists in its settings folder (~/Library/Application Support/LexCloak/ on macOS, with analogous paths on other platforms): unfinished.json, the paths of the files above, so it can offer your work back at launch, and old-choices.json, described below. They hold file paths, plus a random identifier for each piece of unfinished work, and nothing read from your documents: no document content, text, or thumbnails. Deleting either one does not delete any of your files.

Earlier versions of Lex Cloak could save a session file (extension .lexcloak.json) next to your PDF. That file recorded the text of each item you flagged, along with your always-hide and never-hide lists. The current version no longer creates or opens these files. When it finds them, in the folders named in recent.json (the recent-sessions list earlier versions kept) and next to documents you open, it offers to delete them permanently, and you choose which ones go. Files you choose to keep are listed in old-choices.json so you are not asked about them again. You can also delete any of these files yourself, like any other file on your machine.

Lex Cloak also keeps two small files alongside your licence file: one that counts how many free exports you have used, and install.json, which holds the random trial identifier described under The Free Trial. Neither contains document content, text, or file names. Deleting either one resets what it holds.

All payment processing is handled by Paddle as our Merchant of Record. Your credit card number, billing address, and financial data stay with Paddle. Lex Cloak never receives, stores, or processes them.

When you subscribe, Paddle shares only your email address and subscription status with us so we can issue your license key.

When you start checkout, Paddle's script also loads Paddle Retain, a subscription analytics service Paddle acquired in 2022. It is served from profitwell.com, which is Retain's original name and still its address. What it collects is covered by Paddle's Privacy Notice below.

Paddle operates as four affiliated controller entities, each handling customer data within its jurisdiction:

• Paddle.com Market Limited (United Kingdom)
• Paddle.com Inc. (United States)
• Paddle Payments Limited (Ireland)
• Paddle.com Canada Ltd (Canada)

For EU/EEA and UK customers, transfers from Paddle's UK or EEA entities to non-adequate jurisdictions (including the United States) are governed by Standard Contractual Clauses, Module 1 (Controller-to-Controller), per Commission Implementing Decision 2021/914, and the UK ICO's Approved Addendum, as applicable.

For full details on how Paddle handles your information across these entities, see Paddle's Privacy Notice.

When you subscribe, we generate a license key to activate paid features. Your license key is a cryptographically signed token. It contains no personal information and cannot be used to identify you.

The application validates your license key locally (offline). A periodic network check confirms that your subscription remains active. When this check runs (on activation and on each periodic refresh), the application transmits your license key, or on refresh the email address tied to your subscription, together with a device identifier, your operating system, and the application version. We use the device identifier to show you which devices use your license and to support team and multi-device licensing. Our server stores it only as a one-way, salted hash and never stores the raw identifier. This check does not transmit your documents, the text inside them, file names, or any record of how you use the application. As with any internet request, our server receives the IP address of the connection, which we use only for security monitoring and abuse detection, not to track your activity. If the network check fails (for example, if you are offline), the application keeps working offline for up to 30 days before it needs to reach our server again.

Lex Cloak does not have user accounts. There is no password, no profile, and no login. You download the app, and if you subscribe, you enter a license key. That's it.

In the Lex Cloak application: there are no tracking pixels, no cookies, and no third-party analytics. Nothing records what documents you open, what Lex Cloak finds in them, or how often you use the application. Two things the app does reach the network, and neither carries anything about your work: the free trial sends three anonymous notes about the trial itself, described in full under The Free Trial below, and the app checks whether a newer version has been published, described under Checking for Updates.

On the lexcloak.com website: we use Cloudflare Web Analytics, a cookie-free, privacy-focused analytics tool hosted by Cloudflare, Inc. It does not set cookies, does not store raw IP addresses, and does not generate persistent identifiers or fingerprints that could identify a visitor or track them across different websites. How Cloudflare handles this data is described in Cloudflare's privacy policy.

What Cloudflare Web Analytics records when you visit lexcloak.com:

• Aggregate page views, referrer source, derived country/region, browser family, and device type
• Anonymous page-load performance timings (for example, how quickly a page renders), used only to monitor and improve site speed

Starting checkout also loads Paddle Retain, described under Payment Information above. Cloudflare Web Analytics is the only analytics on the website outside of checkout.

Apart from the free-trial notes described below, no analytics data is collected from the Lex Cloak desktop or iOS application. Everything else on this page under analytics refers to the marketing website.

Lex Cloak includes a free trial that lets you export a small number of redacted documents before subscribing. To answer one question, how many people who download Lex Cloak go on to actually try it, the application sends a short note at three points: the first time it opens, the first time you export a document, and the point where the free exports run out.

Lex Cloak does not send these notes while a subscription is active on your machine. A point reached during that time is skipped, and its note is not sent later. On a new machine, Lex Cloak opens for the first time before your subscription is activated there, so the note for that first opening is still sent.

Each note contains four things and nothing else:

• A random identifier, generated on your machine the first time Lex Cloak opens. It is not derived from your name, your email address, your hardware, your network, or anything you have opened.
• Which of the three points the note refers to.
• The version of Lex Cloak you are running.
• A version number for the note format itself.

A note does not contain your document or any part of it, any file name, any file path, any count of pages or documents, or any information about what Lex Cloak found. Your IP address is not recorded, and nothing derived from your IP address is stored.

The random identifier is used only for these three notes, and it appears in no subscription record. A note carries no email address and no licence key, and it does not carry the device identifier described under Data We Collect. If you subscribe later, a note still holds no field in common with your subscription, so there is nothing to match the two on.

The identifier is stored on your machine in a file named install.json, alongside your licence file. Deleting that file resets the identifier. Each note is sent once and is never retried, so if your machine is offline at that moment the note is simply not sent, and nothing is queued or held for later.

Notes are deleted automatically 90 days after they arrive.

While Lex Cloak is running it asks lexcloak.app about once every four hours whether a newer version has been published, and on macOS its updater asks once a day as well. On Windows a newer version downloads in the background and Lex Cloak tells you when it is ready to install. With Install automatically turned on in Settings, as it is by default, it installs the next time Lex Cloak starts. With it off, it installs only when you choose. On macOS Lex Cloak tells you, and when you choose Install it downloads the new version from lexcloak.app, installs it and opens again. Like the check, that download carries nothing about you or your documents.

The check is an ordinary request for a file we publish. It carries no identifier of any kind, no subscription detail, and nothing about your documents or their names. It runs whether or not you have a subscription.

Like any web request it reaches our content delivery network, which keeps access logs for 90 days. Those logs record the date and time, the file requested, the response status and size, the country the request came from, and the app version and platform that Lex Cloak identifies itself with. They do not record IP addresses. That field is deliberately left out when the logs are written, so a request cannot be traced back to your connection. We use these logs to confirm that downloads and updates are being served correctly.

There is currently no setting that turns the update check off. Blocking lexcloak.app at your firewall stops it, and Lex Cloak goes on scanning, redacting, and exporting without it.

The personal information we hold is limited to:

• Email address (subscribers): provided by Paddle when you subscribe. It is used to deliver your license key and to communicate about your subscription.
• Subscription status (subscribers): provided by Paddle, and used to validate your license.
• Email address (iOS waitlist signups): submitted voluntarily through the form at lexcloak.com/ios. See "iOS Waitlist" below for details.
• Voluntary feedback report contents: submitted only when you use the in-app "Report a problem" feature. See "Feedback Reports" below.
• Device and license-check data (subscribers): a one-way (salted, irreversible) device identifier, your operating system, and the app version, recorded against your license to show which devices use your license and to support multi-device and team licensing. This contains no document content and cannot be reversed to identify your machine.
• Free-trial notes (people using the trial): a random identifier that is not derived from you or your machine, which of three trial points the note refers to, and the app version. A note shares no field with any subscriber record, so there is nothing to match the two on. See The Free Trial above.
• Update-check request logs (everyone): the date and time of the request, the file requested, the response status and size, the country the request came from, and the app version and platform Lex Cloak identifies itself with. No IP address is recorded, and the request carries no identifier, so there is nothing in these logs that points to you. See Checking for Updates above.

We do not sell, rent, or share your personal information with third parties for their marketing purposes. We do not use your email address for marketing unless you separately opt in to communications from us.

If you submit your email address through the iOS waitlist form at lexcloak.com/ios, we collect:

• Email address: the address you enter so we can notify you when the iOS TestFlight beta opens.
• A hidden anti-spam field: a honeypot input that ordinary visitors leave empty. Submissions where this field has been auto-filled by a bot are rejected. It does not capture any user input or browser fingerprint.
• A static source identifier: the literal string web indicating the submission came from the website (as opposed to any future submission channel).

Waitlist entries are stored in a DynamoDB table on Lex Cloak's backend at api.lexcloak.com. We use the email address solely to send a single notification when the iOS TestFlight beta opens. We retain waitlist email addresses until the iOS launch and for a 30-day grace window afterward, unless you request earlier deletion. To request deletion before the launch, email help@lexcloak.com.

If you use the in-app "Report a problem" feature, we receive only the information you choose to submit. This is voluntary and user-initiated. No data leaves your device unless you click submit.

What we receive when you submit a report:

• The text you type describing your issue
• A short set of diagnostic fields shown to you before submission: application version, the versions of the PDF and detection libraries, operating system (including OS version), CPU count, license state, and (only if a document is open) that document's page-count range, file-size range, whether it had a native text layer, whether OCR was run, and aggregate counts of detected categories

What we do not receive:

• Your document, the text inside it, or any content from it
• File names, file paths, or file metadata
• Specific match values, character positions, or redaction details

Reports are submitted through the in-app "Report a problem" feature, which opens a report page at lexcloak.app/report with the diagnostic fields above for you to review before sending. We do not train models on feedback reports. For other questions, email help@lexcloak.com.

Your email address and subscription status are retained for the duration of your subscription and for a reasonable period afterward (up to 12 months) for billing records, support, and legal compliance. You may request deletion at any time by contacting us. We will delete your data within 30 days unless retention is required by law.

Lex Cloak keeps your working state only until you finish a document. When you download the redacted copy, it deletes the working state and the file next to the original. Work you have not finished stays on your device until you finish or discard it. Lex Cloak does not back up, sync, or transmit these files. See About Your Working Session for the technical detail.

Free-trial notes are deleted automatically 90 days after they arrive. Because they carry no identifier connected to you, they cannot be looked up, corrected, or deleted on request, and the same property is what keeps them anonymous.

In the unlikely event of a security incident affecting your account information (email address or subscription data), we will notify affected users within 72 hours in accordance with applicable law.

There are no age restrictions for using Lex Cloak's free scanning features. Since the free tier collects no personal information of any kind, it is safe for anyone to use. Subscription purchases are subject to Paddle's terms, which require purchasers to be of legal age.

Depending on your jurisdiction, you may have the right to access, correct, delete, or export your personal data. Since we hold minimal data (email and subscription status only), these requests are straightforward. Contact us at help@lexcloak.com and we will respond within 30 days.

For EU/EEA residents (GDPR): Our lawful basis for processing your email address and subscription status is contract performance (Article 6(1)(b)). It is necessary to fulfill your subscription. You have the right to lodge a complaint with your local data protection authority.

For California residents (CCPA): We do not sell personal information. You may request disclosure of the categories of personal information we collect (email, subscription status) and request deletion.

Lex Cloak's subscription data (email address and status) is processed in the United States. Your documents never leave your device and are not subject to any data transfer.

Payment data is processed by Paddle (our Merchant of Record) across multiple jurisdictions. See Payment Information above for the entities involved and the cross-border safeguards (Standard Contractual Clauses + UK ICO Approved Addendum) that apply.

This policy is effective October 8, 2026.

If we change this policy, we will update this page with the new effective date. We will provide at least 30 days' notice of material changes by email (to subscribers) or on the Lex Cloak website. We are committed to local-first processing and to collecting as little personal data as we reasonably need, and that commitment guides how this policy evolves.

If you have questions about this privacy policy:

• Email: help@lexcloak.com
• Phone: (720) 336-1320
• Mailing address:
  Monty Home, LLC
  1500 N Grant St #7031
  Denver, CO 80203