Kloak sells a Discord alternative that does not watch you. The live FAQ on kloak.app says your messages sit on their servers, end-to-end encryption is future work, there is no registered legal entity, and the mobile app is “not yet.” Google Play lists the same product under Hedge Studio Labs, with a Data safety form that says no data is collected.
Scroll sideways on small screens.
| 0 | End-to-end encryption in production. The FAQ is still “working toward” it. A founder already said messages are readable at the database level. |
|---|---|
| January 2025 | Date on the live privacy policy. About says they quietly opened the doors in January 2026. |
| Not yet | FAQ answer for both the mobile app and the desktop app. Play Store lists Kloak anyway, 500+ downloads, updated 4 August 2026. |
| No company | Terms of service. Play Store developer: Hedge Studio Labs, Lakshika Gayal, Sri Lanka. |
Kloak is a closed-source Discord-shaped chat app: servers, channels, roles, DMs, voice, badges. You sign up with a username and a 64-character “secret key.” The pitch is that privacy is the architecture, not a toggle.
Registration posts to hCaptcha. The content security policy still allows Giphy, Google Fonts, Bunny CDN, Fly.io websockets, Pocketsflow payments, and LiveKit hosts under kibun.social, a previous project by the same founder. The Join page tells volunteers the server never sees your content. The FAQ tells you the opposite: they keep the messages, and encryption that would hide those messages from Kloak is future work.
This page is the product they described, written in English, with the claims checked against the live JavaScript bundles, the Play Store listing, Hacker News, and the public Reddit record. Research current as of 20 September 2026.
Homepage: “The Discord alternative that does not watch you.” Cookie policy: “We built everything in-house because your conversations shouldn’t pass through a dozen different companies.” The production index.html still lists hCaptcha, Giphy, Klipy, Google Fonts, their hosted backend, Fly, Bunny, Pocketsflow, and kibun.social in connect-src / frame-src. Using a hosted database is ordinary. Claiming the conversations never leave the house is the line that does not survive the CSP.
FAQ: GDPR barely applies because Kloak collects “zero personal data,” “no IP logs,” “no analytics,” “no tracking of any kind.” The same FAQ: they collect your username, a hash of your secret key, your messages and content, optional profile information, and server membership records. Google Play’s Data safety form for the official app is even shorter: “No data collected.”
About: the next job is a zero-knowledge system “where even we cannot read your messages.” Join: volunteers are “building tools where the server never sees your content.” A founder, quoted on Hacker News from inside the app: messages “are stored on our servers and are technically accessible at the database level, we won’t pretend otherwise.” AlternativeTo still lists end-to-end encryption as a Kloak feature.
About: January 2026, “No promotion. No marketing campaigns. No launch events.” The same month-ish window: a Show HN by lakshikag, a YouTube promo, posts on r/discordsucks, an AlternativeTo listing, and a dedicated subreddit. The Show HN commenter who actually opened the site found the FAQ returning 404.
About: “No subscriptions. No ads.” FAQ: the core stays free; storage and other “QoL” may become paid upgrades. Buy Me a Coffee sells Lite ($5), Core ($15), and Titan ($45) monthly memberships with roles, profile badges, a private staff server, and “Lifetime of free, paid features, as long as you’re a member.” Titan also promises a t-shirt “when it launches.”
Terms: “Kloak is not a company, and we have never presented ourselves as one. There is no registered legal entity… We don’t generate revenue and we don’t operate under any jurisdiction as a company.” Play Store: developer name Hedge Studio Labs, developer Lakshika Gayal, support email hedgestudio99@gmail.com, country Sri Lanka. Donations run through Buy Me a Coffee, which is a commercial payment processor with its own privacy policy.
You do not need an account to read this. View source on kloak.app. The SPA shell still ships ws://localhost:8787 and http://ipc.localhost in the production Content-Security-Policy. Open Graph still points at http://kloak.app/favicon.png, without TLS. The sitemap lists https://kloak.app//auth with the extra slash. The feature icon for calendars is named calenders.svg.
VITE_SUPABASE_PUBLISHABLE_KEY is set to a service_role key. Use anon/publishable key only and rotate leaked service_role key.
That sentence is in the live client bundle as a runtime check. The key they currently embed is an anon JWT for project foquucurnwpqcvgqukpz. A service_role key in a browser build would bypass row-level security. The check is evidence they know that class of mistake exists.
Google Play names Lakshika Gayal. Hacker News names lakshikag. The same account Show-HN’d Berrylog (“The very first thing I do when starting a new project is add analytics”), Bugdrop, ItsLaunched, Kibun, Nooki, Buzzed.chat, and Allo. Kloak’s CSP still phones home to kibun.social for LiveKit. AlternativeTo listed the developer as “Jim.” A comment on an official Kloak YouTube video said AI tooling was used “when it was just Jim working on it.”
About says a team of roughly five, spare time, day jobs. The first Show HN said “two of us.” The Join page advertises 23 volunteer seats and asks engineers to be comfortable with Cursor, Lovable, Claude, or GitHub Copilot. Open source is “definitely something we’re considering,” after they clean up the codebase. That sentence has been on YouTube since February 2026.
Founder · The February rebuild