About

# Why this exists, and what it refuses to do.

CloakDrop encrypts files in your browser before anything else happens. The interesting part is not the encryption — that is a solved problem. It is everything the design gives up in order to keep it.

Written during the public preview: the encryption is finished and you can run it today, the relay that carries a drop from one person to another is being built.

The premise

## Most services ask you to trust them. This one tries to make that unnecessary.

Sending a file to someone is a solved problem in every way except one: almost every service that does it can read what you sent. Not maliciously, usually — just structurally. The bytes arrive readable, so they are readable, and what protects them from then on is a policy document and the good behaviour of everyone who ever touches the storage.

CloakDrop starts from the other end. Your browser generates a key, encrypts the files with it, and writes the key into the fragment of a link — the part after the #, which browsers never send to a server. In this preview nothing leaves your device at all: the encrypted chunks stay in the storage of the browser that made them. Once the relay carries them, what travels is ciphertext, an 8-byte IV prefix and a timestamp. Not because we promise not to look, but because there is nothing there to look at.

That choice costs things, and the honest version of this page is the list of what it costs. There is no password reset, because there is no password we hold. There is no recovering a lost link, because the key only ever existed inside it. There is no server-side search, no virus scanning, no “open in the app” — every one of those needs a server that can read your files. Lose the link and the files are gone. That is not a gap in the design. It is the design, seen from the side that costs something.

What is left is small and checkable. You can watch it happen in your own dev tools — four checks, about a minute each, written down step by step — and when the client is published you will be able to read the code that does it.

Principles

## Four rules, each with something behind it

Stated the way the rest of the site states things: with a link to the page where you can check it.

### Cryptography over policy

A privacy policy is a promise you cannot check. A key that never leaves your browser is a mechanism you can. Where the two compete, the mechanism wins.

Proof: four checks you can run

### Honest about order, silent about dates

What is next has an order and no dates. Order is something we control; delivery dates on a small project are guesses dressed as commitments — so none are published, here or anywhere.

### Read the source beats trust me

The client is readable in full, in the page you are on, because that is the only way a zero-knowledge claim can be checked. It is not licensed for redistribution — reading and verifying need no licence.

Proof: the commitment, in writing

### Say plainly what is not built

The unfinished parts are named where they appear — the 500 MB preview cap and the relay that does not exist yet. Nothing is dressed up as shipped.

Proof: what is finished, and what is not

Where it stands

## The state of the project, in four rows

The same four stages the roadmap uses. Nothing here is a date.

Shipped Browser-side AES-256-GCM, 4 MB chunking, the encrypted manifest, the link format, a 500 MB preview cap, a chosen expiry counted in the browser and a delete that really removes the chunks.All of it runs in the tab you have open. The encrypted chunks stay in that browser’s storage, so the link you get back opens the drop for you and shows nothing to anyone else.
In progress The relay that carries a drop between people.It will hold ciphertext, an IV prefix and a timestamp — never a key, and never an account: nothing here asks who you are, and that is not going to change. Until it exists there is no upload and no download in CloakDrop.
Up next The open-source release and a security whitepaper.Both queued behind the relay, because neither is worth much without it.
Exploring A receive inbox, a developer API, reproducible builds.Ideas we like enough to write down and not enough to promise.

The honest part

## What an About page usually has, and this one does not

Four omissions, each on purpose.

###
No team page

There is nothing about us you could verify, and a page of faces would ask you to trust exactly the thing this product is built to make unnecessary. Judge the mechanism instead.

###
No founding story

It would be a nice paragraph and it would tell you nothing about whether your files are readable. The glossary and the verification page are the honest version of an origin story.

###
No user numbers

We do not count you. There are no accounts, nothing about a transfer is reported anywhere, and a number we cannot source is a number we will not print.

###
No launch date

The relay ships when it works. Saying otherwise would cost the same thing the missing password reset costs — and buy less.

### One address, for the parts that do not hold up

Disagreements about the design are more useful than compliments about it. If something here is wrong, or a claim does not survive your own check, that is worth an email.

hello@cloakdrop.com

## Do not take our word for it.

Check it yourself