Cloaked

1.1 Identity, product scope, and operating model

Cloaked was founded in 2020 by brothers Arjun and Abhijay Bhatnagar around a simple but resonant thesis: it should be normal to use the internet without constantly exposing your real identity. The origin story is unusually personal. Arjun says the idea came after he built a personal "databox" AI that combined his messages, finances, health data, and routines, only to discover it could act on his behalf in unsettling ways. That experience turned a general privacy concern into a concrete product mission. The initial product was an identity layer: unique phone numbers, email addresses, passwords, and other account identifiers that let users sign up, shop, or communicate without disclosing their real details. Over time, Cloaked expanded that narrow identity abstraction into a broader privacy suite that now spans broker-data removal, dark-web and SSN monitoring, password management, VPN, AI-assisted call screening, and identity-theft insurance. The business model appears to be subscription-led on the consumer side, with an increasingly visible enterprise layer that packages the same protection stack for employees. Public materials also show a product roadmap still in motion. Cloaked Pay is publicly described as a beta or near-launch product, and the privacy policy confirms it requires extra KYC-style financial data. The company is also talking about AI-driven personal agents to automate privacy management. Together, that positions Cloaked less as a single-feature utility and more as an attempt to become a default privacy operating layer for both households and workplaces.[CO001, CO002, CO003, CO004, CO005, CO006]

1.2 Leadership, governance, and corporate footprint

Leadership is still founder-centric. Arjun Bhatnagar is the public-facing CEO and Abhijay Bhatnagar is the CTO and, in some public bios, chief AI officer. Their prior collaboration on Hey! HeadsUp supports a repeat-founder narrative, and the founding story gives them clear founder-market fit in consumer privacy and identity tooling. Publicly visible governance, however, remains fairly thin. The clearest board datapoint in the reviewed corpus is Lux Capital partner Bilal Zuberi joining the board alongside the March 2022 Series A, which implies outside investor oversight but does not amount to a fully transparent board picture. Cloaked does appear to have built a broader executive bench. Its about page lists a Chief Experience Officer, General Counsel/CCO, CISO, VP of Finance, VP of Customer Success, and several functional heads, while Craft names Michael Abbate as Chief Experience Officer. That suggests the company is no longer run only by the two founders, even if it still depends heavily on them. The more material diligence issue is corporate footprint ambiguity. Company press releases in 2024 and 2026 say Cloaked is based in New York City, while Craft and Tracxn list a Lowell, Massachusetts address and Tracxn points to an active US legal entity, CLOAKED, INC. TechCrunch's 2022 coverage called the company Boston-based. The most defensible reading is that Cloaked has a Massachusetts legal footprint and later adopted New York City as its operating-base identity, but the exact split is not fully documented in public sources.[CO002, CO016, CO017, CO032, CO033, CO034]

1.3 Funding history, investors, and stage

Cloaked is now clearly a later-stage private company. On 19 March 2026 it announced $375 million in Series B and growth financing led by General Catalyst and Liberty City Ventures, with Lux Capital, Human Capital, Marquee Ventures, Fifth Growth Fund, NFL Players Association, LG Technology Ventures, Assurant Ventures, DuckDuckGo, and others participating. Multiple sources say General Catalyst's Customer Value Fund supplied the growth-financing component, which matters because it means the round was not a clean equity raise. What the company did not disclose is just as important. TechCrunch and TechFundingNews both say Cloaked withheld the post-money valuation and the precise split between equity and growth capital. That omission should be treated as a real evidence gap rather than backfilled with third-party guesses. Independent profile sites speculate about low-billion-dollar enterprise values, but those marks are not company-confirmed and should not be treated as a canonical valuation. Earlier funding history is clearer. Cloaked's March 2022 Series A was a $25 million round co-led by Lux Capital and Human Capital. Because that announcement described total funding to date of $29 million, the implied seed capital before Series A was roughly $4 million, consistent with third-party database summaries. The cap table has since evolved into an unusually broad coalition spanning traditional VCs, strategic privacy players such as DuckDuckGo, corporate investors, and the NFLPA, which doubles as a possible distribution channel for high-risk professional-athlete cohorts.[CO007, CO008, CO009, CO010, CO011, CO012]

1.4 Scale signals, milestones, and adverse evidence

Public traction signals are meaningful but should be read carefully. TechCrunch reported more than 350,000 paying customers and 10x growth in March 2026, while Cloaked's about page later said the company had a community of more than 400,000 users. Those figures point in the same direction but are not the same KPI. The company also claims it has protected more than 10 million identities, removed more than 1 billion records from data-broker sites in March, and now more than 1.7 billion on the homepage. Call-screening counts similarly progressed from more than 40 million to 50 million to 60 million-plus across sources, which suggests real growth but also reminds us that these are company-published operating metrics rather than audited disclosures. Milestone sequencing is coherent. Cloaked says it exited beta in October 2023, launched AI-powered call screening in 2025, and entered enterprise in late 2025. PRWeb's enterprise launch release says that offering was already protecting thousands of employees and named the Chicago Cubs as a customer; Forbes adds that NFL Players Inc. invested with an eye toward rolling the service out to current and former players. That makes the enterprise push look less like an abstract adjacency and more like an early go-to-market wedge around high-risk populations. The main adverse evidence is not existential, but it is real. Archived Trustpilot reviews show a respectable 4.2 out of 5 overall rating while still containing complaints about refunds, slow support, and ongoing robocalls. Aura and Cape both argue that Cloaked is feature-rich but uneven: pricing appears to have changed during 2026, some protections lag best-in-class competitors, and support quality is inconsistent. In other words, Cloaked looks commercially significant, but still operationally immature in ways a diligence process should test directly.[CO018, CO019, CO020, CO021, CO022, CO023]

1.5 Exhibits

2.1 Market boundary and status-quo substitutes

Cloaked is not just a classic credit-monitoring or post-fraud restoration vendor. Its own consumer materials define a prevention-first stack: data removal from broker sites, masked email and phone identities, spam and scam call interception, password management, and identity-theft insurance. BusinessWire, TechCrunch, and PRWeb describe the same bundle in enterprise form, where employee exposure is treated as part of the corporate attack surface rather than only a personal-finance problem. That places Cloaked inside the identity-theft-protection market, but at the edge where privacy, data-removal, and digital-safety tooling are converging. The included spend is therefore narrower than the entire privacy or cybersecurity landscape but broader than legacy credit monitoring alone. Included categories are consumer identity-protection subscriptions, family digital-safety bundles, employer-sponsored identity-protection benefits, employee and executive privacy-removal services, and prevention tooling that keeps real identifiers out of circulation before fraud occurs. Excluded spend includes general endpoint security, consumer VPN-only subscriptions, enterprise IAM suites, generic password managers sold without identity or privacy features, ad-tech spending by data brokers, and broad privacy-compliance consulting. Status-quo substitutes remain strong. For consumers, the alternatives are free credit freezes, no-cost credit monitoring from bureaus or banks, carrier spam filtering, and ad hoc opt-outs from broker sites. For employers, substitutes include security-awareness training, EDR, phishing protection, and benefits bundles that do not include identity or privacy remediation. That boundary matters because the biggest public number in the ecosystem — the data broker market — measures the monetization problem, not the amount buyers currently spend to solve it.[CM001, CM002, CM003, CM004, CM005, CM006]

2.2 Sizing lenses: core market, adjacent pool, and constrained SAM proxy

A one-line TAM would overstate what is actually supported by public evidence. The cleanest core-market lens is identity theft protection services. The Business Research Company sizes that market at USD 16.26 billion in 2026, while Fortune Business Insights sizes it at USD 19.45 billion in 2026; IMARC uses a smaller base, putting the market at USD 12.3 billion in 2025 with a 2026-2034 CAGR of 8.97%. Javelin then shifts the lens to the United States, arguing the U.S. market is poised to reach USD 18 billion by 2027 and that direct-to-consumer sales still dominate, though their share is declining. MarkWide places the U.S. market at USD 13.8 billion in 2026. These numbers are not directly interchangeable, but they consistently show a multi-billion-dollar category growing at high-single- to low-double-digit rates. The adjacent pool is much larger. Mordor Intelligence estimates the data-broker market at USD 315.66 billion in 2026, with consumer data representing 46.03% of the 2025 mix. That is the upstream monetization engine behind Cloaked's value proposition: if data brokers create the inventory that feeds spam, phishing, and identity theft, then privacy-removal and alias products are attacking the source of the problem. But that USD 315.66 billion figure is not Cloaked's TAM; it is the size of the ecosystem benefiting from exposed personal data. The most defensible public SAM proxy for Cloaked is a constrained subset: North American and U.S. identity- protection spend, plus the emerging employer-benefits and enterprise workforce-protection motion documented by Javelin, Allstate, DeleteMe, Optery, and Incogni. Public sources do not isolate a clean revenue bucket for aliasing plus data removal plus spam blocking plus employee digital-risk protection. The right conclusion is therefore not a generic "huge market" claim, but that Cloaked is entering a real core category with multiple adjacent expansion paths and no single public source that cleanly defines the whole bundle.[CM010, CM011, CM012, CM013, CM014, CM015]

2.3 Buyer, user, and payer segmentation

The buyer map is at least three-part. First is the direct consumer who wants to reduce identity exposure, stop spam, and protect financial accounts. Second is the family buyer, where protection is justified by children, spouses, and older relatives rather than a single account holder. Third is the employer or enterprise buyer, which itself splits between HR or benefits teams offering identity protection as a workforce perk and security teams treating employee exposure as a human-risk problem. Cloaked's current positioning touches all three. Javelin's research is particularly important because it shows a channel transition rather than just feature expansion. Direct-to-consumer subscriptions still dominate U.S. identity-protection sales, but they are losing share as buyers seek trusted third-party partners and bundled distribution. Allstate explicitly sells identity protection as an employee-employer benefit that protects family and productivity. MarkWide likewise highlights employer-sponsored benefits as a strategic opportunity. That makes buyer access, not just category size, a core part of the market thesis. The competitive bundle also changes who signs the budget. DeleteMe, Optery, and Incogni sell executive and employee privacy-removal to security teams worried about social engineering, doxing, ransomware, and physical threats. Aura and LifeLock sell broad family and financial-safety packages to household buyers. Cloaked's aliases and call screening make it more prevention-led than pure monitoring providers, but its enterprise case still depends on whether CISOs, HR leaders, and benefits managers can justify privacy tooling as a recurring budget line rather than a one-off remediation service.[CM018, CM019, CM020, CM021, CM022, CM023]

2.4 Growth drivers, adoption constraints, and valuation relevance

The demand backdrop is strong and measurable. FTC reporting, IC3 complaint volumes, ITRC breach tracking, YouMail robocall counts, and Truecaller spam-call data all point to a persistent digital-safety problem rather than a cyclical fad. ITRC's 2025 report adds an especially relevant bridge to Cloaked's positioning: breach victims report more spam emails, robocalls, phishing, and account-takeover attempts after exposure. That directly links data-breach prevalence to demand for data-removal, aliasing, and scam-blocking products. Analyst reports reinforce the same story, repeatedly citing more online transactions, more cybercrime, and more enterprise concern about fraud as the category's core growth drivers. The brakes are just as important. Fortune, TBRC, and MarkWide all imply that cost, free substitutes, and operational complexity still limit adoption. Consumers can freeze credit without paying a subscription. Banks and credit bureaus give away pieces of the value proposition. Enterprise buyers can address part of the problem with training, call filtering, EDR, or manual opt-out workflows. Public market data also remains structurally noisy: the same "identity protection" label can mean credit monitoring, restoration insurance, family digital safety, executive privacy removal, or workforce protection. That has direct valuation implications. Cloaked's upside is best understood as winning a prevention-centric share of a documented identity-protection market while expanding distribution through family, benefits, and enterprise- security channels. Its downside is not that demand is imaginary, but that buyer education, packaging, and budget ownership remain unsettled. Investors should therefore underwrite the category using multiple lenses and distribution assumptions, not a single data-broker number or a single generic TAM estimate.[CM027, CM028, CM029, CM030, CM031, CM032]

2.5 Exhibits

3.1 Landscape: direct removers, identity suites, masking tools, and point substitutes

Cloaked does not compete inside a single neat category. The most direct alternatives are DeleteMe and Incogni, both of which sell data-broker and people-search removal as the core job. Aura, Norton LifeLock, and PrivacyHawk solve a wider consumer-protection problem by combining removal with insurance, credit or fraud monitoring, remediation workflows, and family packaging. IronVest overlaps more narrowly on identity masking, phone or payment obfuscation, and anti-fraud controls, while Apple Hide My Email and Google Voice undercut a portion of the problem with low-cost email or phone masking rather than full privacy orchestration. That matters because the buyer’s comparison set changes with the pain point. If the buyer wants maximum broker coverage at the lowest price, Incogni and DeleteMe are the most relevant benchmarks. If the buyer wants a broad identity-protection bundle, Aura and LifeLock become harder to ignore. If the buyer mainly wants to stop giving out a real email address or phone number, Apple, Google, and IronVest can satisfy a subset of the job without paying for a full suite. Cloaked’s real competitive task is therefore to prove that prevention plus cleanup is a meaningfully better consumer outcome than buying best-of-breed removals or several cheaper point tools.[CP001, CP022, CP023, CP024, CP025, CP030]

3.2 Head-to-head capability and pricing: where Cloaked leads and where it does not

Cloaked’s strongest public differentiation is prevention. Its own product surfaces combine masked email and phone identities, data removal, dark-web and SSN alerts, spam-call blocking, VPN access, password management, and identity-theft insurance. That is a broader day-to-day privacy story than DeleteMe or Incogni, whose public materials emphasize post-exposure cleanup rather than alias creation, phone shielding, or preventative identity compartmentalization. For a consumer who wants one subscription that both stops new leakage and cleans up old leakage, Cloaked is closer to a unified bundle than the direct-removal leaders. The disconfirming evidence is substantial. Incogni’s public pricing is lower and its official materials plus multiple reviews point to broader automated broker coverage. DeleteMe leans on human privacy experts and a long- standing quarterly reporting workflow that some buyers will trust more for messy real-world footprints. Aura, LifeLock, and PrivacyHawk all offer more explicit insurance or credit-oriented remediation packaging than Cloaked, and Apple or Google can satisfy the narrow masking use case at much lower entry prices. The competitive picture is therefore not that Cloaked wins every row; it wins when the buyer values prevention, convenience, and bundled privacy controls more than any single best-of-breed metric.[CP002, CP003, CP006, CP008, CP009, CP010]

3.3 Trust, support, and distribution posture

Trust signals are uneven across the field and matter because consumer privacy buyers are outsourcing a highly sensitive workflow. DeleteMe leans on age, visible customer support, quarterly reports, and an A+ BBB rating. Aura and LifeLock lean on insurance, fraud-remediation workflows, credit monitoring, and broader cybersecurity framing. Incogni’s strength is less human assurance than automation and category value, reinforced by repeated independent rankings. PrivacyHawk’s positioning is app-first and consumer friendly, but it receives less independent long-form evaluation than the top three removal brands. IronVest has a distinct privacy-security architecture story, but the independent review record frames it as a narrower anti-fraud or masking tool than a comprehensive removal vendor. Distribution and support posture also shape moat. Aura, LifeLock, DeleteMe, and PrivacyHawk expose family or multi-person packaging more clearly than Cloaked’s retained public evidence does, and DeleteMe also pushes a business plan. PrivacyHawk is explicitly mobile-app centered, IronVest and Google Voice support browser plus mobile usage, and Apple’s substitute is tightly tied to the Apple account and iCloud ecosystem. By contrast, retained public evidence for DeleteMe and Incogni is more web-dashboard oriented than app-led. These differences do not decide the market alone, but they affect how easily each rival can fit different household, budget, and operating habits.[CP012, CP015, CP018, CP021, CP026, CP029]

3.4 Moat durability: real differentiation, but meaningful execution risk

Cloaked’s moat is credible only in a specific shape: a consumer bundle that combines proactive masking, reactive removal, and identity support in one workflow. That combination is genuinely differentiated against Incogni and DeleteMe, which are optimized for cleanup, and against Apple or Google, which only address slices of the prevention problem. The retention logic is intuitive: once a user has segmented accounts behind aliases, linked them to call screening and monitoring, and uses the product as an everyday privacy layer, switching away can mean rebuilding habits rather than merely canceling a report service. But the public evidence also shows why the moat should not be overstated. Cloaked’s own marketing surfaces do not present one stable current number for broker coverage or usage scale, which weakens confidence in precision around category leadership. Incogni appears better on raw removal coverage and price, DeleteMe retains a strong trust position around human-assisted removals, and Aura or LifeLock are better established for credit-heavy remediation. Meanwhile, cheaper substitutes like Apple Hide My Email, Google Voice, and IronVest can erode the willingness to pay for the prevention side of the bundle. The likely verdict is not that Cloaked lacks a moat, but that its moat depends on execution quality, product clarity, and proving superior consumer outcomes rather than merely advertising more features in one subscription.[CP004, CP005, CP027, CP028, CP030, CP031]

3.5 Exhibits

4.1 Consumer revenue model, pricing, and monetization surface

Cloaked's clearest monetization surface is a paid consumer subscription sold in individual, couple, and family tiers. The official plans page shows a current monthly individual price of $12.49, annual individual billing of $119.99, a couple plan at $19.99 monthly and $174.99 annually, and a family offer for up to four people at $29.99 monthly. Official pricing metadata also says plans start at $9.99 per month, which matches third-party trackers that still show lower annual-equivalent entry pricing. The subscription bundle is broader than a simple alias or password-manager SKU: current public surfaces package identity-theft insurance, data removal, call screening, dark-web and SSN monitoring, VPN, and other privacy features into the same paid product. That breadth matters financially because it supports premium positioning, but it also suggests a cost stack with third-party insurance, telecom, fraud-detection, and data-removal obligations that public sources do not quantify. The company is also gesturing toward future monetization beyond the base plan through enterprise contracts, eSIM, and future Cloaked Pay or AI products, but public evidence still stops at list pricing and feature breadth rather than contract economics.[CI001, CI002, CI003, CI004, CI005, CI006]

4.2 Traction proxies and public revenue bounds

Cloaked's public traction signals are unusually strong for a private consumer-security company, but they still do not resolve into a clean ARR number. The founder post says Cloaked has 350,000+ subscribers, while TechCrunch independently reported more than 350,000 paying customers and 10x growth last year. The about page says the company has a community of over 400,000 users, and the homepage says 4 million Americans have taken its free scan. Read together, those figures imply a funnel that likely begins with a free exposure scan, converts some fraction into app installs, and then converts a further fraction into paid subscriptions. App-store surfaces reinforce that this is not a paper user base: Apple's listing shows a 4.5 rating across 6.5K ratings, and Google Play shows a 4.1 rating, 5.34K reviews, and 100K+ downloads. Even so, public financial modeling remains constrained. At the cheapest current official annual individual price, 350,000 paying subscribers imply only a gross consumer list-price floor of roughly $42 million annualized; at the lowest current monthly individual price, the same subscriber base implies roughly $52.5 million annualized. Those are useful boundary conditions, not revenue disclosures, because plan mix, discounts, trials, churn, refunds, enterprise revenue, and payment timing are all undisclosed.[CI012, CI013, CI014, CI015, CI016, CI017]

4.3 Financing surface, filing evidence, and capital adequacy limits

The most concrete financial positives are access to capital and the company's ability to keep investing. Official sources show a $25 million Series A in 2022 and a $375 million Series B raise and growth financing in March 2026, for at least $400 million of announced financing across the retained official round announcements. The SEC record is more nuanced. Cloaked's March 27, 2026 Form D shows a first sale date of February 9, 2026, a $133.2 million total offering amount, $116.7 million sold, 25 investors, and a note that $58.2 million of the sold amount reflected SAFEs converting into Series B preferred stock. The April 2022 Form D shows a $25.05 million offering, $20.0 million sold, and seven investors. In other words, the SEC sold amounts visible in the retained filings total only about $136.7 million, far below the official $400 million announcement sum. That does not mean the official number is wrong; it means public observers cannot reconcile the full 2026 headline financing from sold equity alone. The most plausible interpretation is that the headline number includes growth financing or other capital not fully represented in the retained Form D sold amount. Hiring behavior is directionally supportive: the company's live jobs page still advertises engineering, product, recruiting, support, and finance roles, including a senior financial analyst. What remains missing is the actual balance-sheet view — no retained source discloses cash on hand, monthly burn, runway, or debt balances.[CI020, CI021, CI022, CI023, CI024, CI025]

4.4 Cost structure, margin path, and adverse user-value signals

Public sources make it possible to sketch cost drivers, but not to quantify them. Cloaked is not selling a single lightweight software seat. The bundle includes broker removals, identity-theft coverage, spam and robocall screening, dark-web monitoring, VPN, and privacy identities, with Google Play also describing an eSIM add-on. Each component likely carries external service-delivery costs: insurance underwriting, telecom or eSIM relationships, support labor, fraud tooling, and continuous data-removal operations. That does not disprove an attractive gross-margin model, but it makes a pure-password-manager margin assumption unrealistic. Independent reviews also signal some pressure on pricing power and support economics. PCMag rated the product highly but still called it relatively expensive. Aura argued that Cloaked falls short of best-in-class alternatives on some feature depth, and JustUseApp collected materially negative combined sentiment with complaints around pricing, account access, and support. Even Trustpilot's generally positive snapshot mentioned user-experience and support friction. Those sources do not prove churn, but they do suggest that realized retention and service cost deserve scrutiny rather than being assumed away.[CI007, CI008, CI009, CI010, CI011, CI038]

4.5 Financial verdict and diligence blockers

The supportable financial verdict in June 2026 is that Cloaked has crossed the threshold from concept to monetized consumer platform, but it has not crossed the threshold to underwritable transparency. Pricing is public. Subscriber scale is public. App-store usage, review volume, and free-scan volume are public. Financing access is public, and recent capital plus continued hiring argue against immediate financing distress. Those are real positives. The blockers are equally real. No retained public source discloses realized revenue, ARR, enterprise mix, gross margin, CAC, payback, churn, NRR, cash, monthly burn, runway, or debt. The SEC record explains some of the financing surface but not the entire $375 million headline figure. Product-surface inconsistencies on broker-removal counts also remind investors that even commercial KPIs need reconciliation across channels. A disciplined next step is therefore not to back-solve a heroic revenue number; it is to request the underlying billing, cohort, gross-margin, and cash materials. Until that happens, Cloaked looks fundable and commercially credible, but still not fully underwritable on revenue quality or capital adequacy.[CI031, CI032, CI033, CI044, CI045, CI046]

5.1 Cloaked’s product is a privacy operating layer, not just an alias generator

Public evidence shows that Cloaked is trying to own the entire personal-exposure workflow rather than one narrow privacy task. The retained official pages repeatedly bundle generated identities, data removal, dark-web and SSN monitoring, Call Guard, insurance, VPN, password management, and a still-limited Cloaked Pay surface into one membership. In customer terms, that means Cloaked wants to both fix the past by scanning and removing already-exposed data and protect the future by making every new signup, call, and purchase use disposable or compartmentalized credentials. The strongest evidence is around identity generation, browser-based autofill, and removal workflow. The weakest evidence is around how broadly some of the newer modules are actually available, because public copy still conflicts on broker counts, iPhone requirements, and whether Cloaked Pay is invite-only, beta, or effectively coming soon. That makes the product real, but not uniformly mature across every advertised module.[CE001, CE002, CE003, CE004, CE005, CE006]

5.2 The visible architecture layers browser and mobile surfaces over routing, screening, removal, and monitoring services

Cloaked’s public architecture is specific enough to map without guessing at internal systems. On the front end, the Chromium extension, dashboard, and mobile apps are the visible control surfaces. Beneath them sits an identity layer that can mint proxy emails, phone numbers, usernames, passwords, one-time passcodes, and in some cases payment identities. Communications then flow through Cloaked-managed inboxes, forwarding logic, and call-screening surfaces, while exposure cleanup and breach monitoring sit in parallel rather than as one monolithic function. The practical implication is that Cloaked’s moat, if it has one, comes less from any single feature than from stitching these modules into a single daily-use workflow. The browser extension is especially important because it is where autofill, OTP capture, identity generation, and on-web usage actually converge. Public release notes reinforce that this layer receives active product attention, which makes the extension a real delivery surface instead of a thin marketing accessory.[CE003, CE007, CE014, CE015, CE018, CE019]

5.3 Trust posture is partly documented in policy and release notes, but enterprise assurance still leans heavily on company-authored claims

Cloaked does publish enough policy and changelog detail to support some bounded technical claims. The privacy policy states that passwords are stored salted and hashed or encrypted, names a Data Protection Officer, and makes explicit that CloakedVPN depends on PureVPN while Cloaked Pay and linked financial workflows can involve Plaid, PayPal, and Stripe. The trust FAQ adds one meaningful minimization detail by saying the free exposure scan does not store the submitted phone number. Release notes also show security work over time, including zero-knowledge inbox encryption upgrades, email API hardening, and DNC registration for Cloaked numbers. What the retained evidence does not do is independently verify the enterprise-assurance claims that appear in the PRWeb launch. ISO 27001, ISO 27701, PCI, and SOC 2 Type II are all plausible and important if true, but in this pack they remain company-authored statements rather than separately retained certificates or trust-center documents. The result is a trust posture that is directionally credible but still under-documented for enterprise underwriting.[CE016, CE017, CE021, CE022, CE023, CE029]

5.4 The product is actively maintained, but newer add-ons and some support claims still show public-evidence gaps

There is real maintenance signal here. The current Chrome and App Store listings show recent versions close to run date, and changelog pages document concrete work on extension UX, encryption, OTP support, pixel blocking, and anti-spam mechanics. Independent reviews also confirm that Cloaked is more than a temporary-email tool in day-to-day use. Even so, the quality and maturity picture is uneven. PCMag explicitly treats the product as broader than a simple alias service but not as the strongest specialist across every component. Trustpilot shows both praise for spam reduction and support responsiveness and complaints about refund friction, valid-call handling, and unresolved spam. Aura’s competitor review predictably leans negative, but it still points at a real issue: some modules are thinly evidenced relative to the breadth of the marketing bundle. The prudent technical verdict is that identity generation, extension workflow, and core cleanup are the most mature public surfaces, while enterprise assurance, AI roadmap claims, and Cloaked Pay readiness still warrant direct diligence.[CE030, CE031, CE032, CE036, CE037, CE038]

5.5 Exhibits

6.1 Segments and core use cases

Cloaked’s customer map starts with a subscription-led consumer business, but the company no longer markets to a single generic privacy enthusiast. Its pricing and copy now separate buyers into Individual, Couple, and Family tiers, with the household packages positioned around children, spouses, and shared digital risk. The product promise is consistent across those tiers: mask the real phone number and email, remove exposed broker data, block scam or robocall traffic, and backstop the user with identity-theft insurance. That makes the real segmentation less about feature unlocks than about who needs protection together and how many identities must be managed under one plan. Public materials also show a second segment: employers that want workforce privacy tooling for employees and administrative visibility for HR or security teams. In other words, Cloaked is trying to sell both direct-to-consumer peace of mind and employer-sponsored digital safety, using the same core privacy stack in both channels. Third-party pricing trackers also describe a free-trial entry path, reinforcing that signup friction is intentionally kept low.[CU001, CU002, CU003, CU004, CU005, CU006]

6.2 Adoption and customer proof

Public adoption evidence is strongest when the company’s own metrics and the independent customer-proof surfaces are kept separate. Cloaked claims a community of more than 400,000 users, more than 350,000 paying subscribers, more than 4 million free scans, 10 million protected identities, over 1 billion broker records cleaned, and more than 50 million scam or spam calls processed. Those are directionally impressive, but they remain company-published operating KPIs rather than independently audited cohorts. Independent proof is more modest but real. Apple shows a 4.5 rating from about 6.5K ratings, Google Play shows a 4.1 rating with about 5.34K reviews and 100K+ installs, Product Hunt shows a 4.8 rating from 38 early-adopter reviews, and Trustpilot shows a 4.1 rating with roughly 360 reviews. Together, those sources confirm meaningful consumer adoption; they do not independently validate retention, conversion, or the exact definitions behind Cloaked’s subscriber and community metrics.[CU011, CU012, CU013, CU014, CU015, CU016]

6.3 Enterprise proof and expansion

Enterprise evidence is credible, but still thin. Cloaked’s own enterprise materials and launch release show a product built for HR and security administrators, with features like alias identities, broker cleanup, dark-web monitoring, password management, and insurance. The most concrete named customer is the Chicago Cubs: the enterprise site and launch release quote a Cubs HR executive, and Forbes says the team was one of Cloaked’s first B2B partners. A second enterprise-adjacent wedge is the NFL Players Inc. relationship, which is currently more channel option than deployed customer proof. Forbes reports that NFL Players Inc. invested in Cloaked and wants the product available to current and former players, which could produce a large high-risk cohort if the relationship scales. Beyond those examples, Cloaked references unnamed deployments across healthcare, fintech, education, government, and sports, but public contract values, exact seat counts, renewals, and case-study outcomes are still mostly missing.[CU030, CU031, CU032, CU033, CU034, CU035]

6.4 Durability, support, and risk signals

The durability story is where Cloaked’s public evidence gets weakest. There is no disclosed NRR, GRR, churn, or cohort data, so investors have to infer stickiness from proxies: large app-store review volume, detailed Trustpilot testimonials, months-long user comments, and the fact that several public reviews discuss upgrades or ongoing usage instead of one-time trials. Those positives are offset by a meaningful complaint trail. Google Play reviews mention call-setup glitches and continuing spam; JustUseApp aggregates negative reports around cancellations, unavailable features, and account access; and BBB complaints from spring 2026 show refund disputes, setup failures, call-routing bugs, and difficulty reaching human support. Cloaked often appears to respond and process refunds, so this is not an abandoned support surface. But the pattern still matters because the company is selling trust, identity continuity, and family safety. Support friction and feature drift are not cosmetic here; they are direct churn and reputational risks. That gap is especially important because enterprise proof is still concentrated in a very small named set.[CU023, CU024, CU025, CU026, CU027, CU028]

6.5 Exhibits

7.1 Product trust, support load, and public-claim consistency

Cloaked’s most immediate diligence risk is not whether the privacy problem exists; it is whether a broad, trust-sensitive product can keep customer experience aligned with its marketing copy. Public complaint sources show a real brand-trust gap. Trustpilot still reflects an overall 4.2/5 score, but the visible review mix includes recurring complaints about slow or hard-to-reach support, call-blocking false positives, refunds, and no measurable drop in robocalls for some users. BBB is more direct: the business profile carries a B rating, and the published complaint record shows refund disputes, onboarding failures, verification-code loops, and reports that Call Guard or identity-generation problems left paid subscribers unable to use the service. JustUseApp and Google Play add lower-confidence but directionally similar criticism around account access, slow removals, and misleading expectations. The more important issue is that product copy itself is inconsistent across public surfaces. Company-operated pages variously claim 400+, 140+, or 120+ broker removals. User and call-screening KPIs also drift by channel. None of those gaps proves fraud, but in a privacy product they do matter: buyers are explicitly outsourcing trust, accuracy, and technical reliability. A company can survive mixed reviews; it is harder to survive a pattern where support, setup, and efficacy claims need a footnote on every channel. That makes product trust risk both a conversion issue and a retention issue, especially if Cloaked is trying to move upmarket into enterprise buyers who will diligence operational maturity more aggressively than consumer app buyers.[CR001, CR002, CR003, CR004, CR005, CR006]

7.2 Funding, valuation, and disclosure opacity

Cloaked’s March 2026 financing clearly improved its capital position, but it also created a fresh diligence problem: the headline is large while the economics remain hard to underwrite from public evidence. Official and independent coverage agree on the $375 million headline and on the involvement of General Catalyst’s Customer Value Fund, which means the round was explicitly a mix of Series B equity and growth financing rather than a plain-vanilla venture raise. TechCrunch also states that Cloaked did not disclose either valuation or the split between equity and growth capital. That matters because investors cannot infer dilution, liquidation preference pressure, or the degree to which the headline round reflects financing against future customer acquisition rather than clean balance-sheet capital. The SEC record sharpens the risk rather than resolving it. The 2026 Form D shows a $133.2 million offering amount, $116.7 million sold, and a large SAFE conversion, but that still does not reconcile the full $375 million announcement. Public employee counts are similarly noisy, with TechCrunch saying nearly 70 employees while BBB lists 50. Again, none of this disproves the underlying growth story. It does, however, mean Cloaked is capital-mature faster than it is disclosure-mature. For a business selling trust, investors should treat valuation opacity, KPI drift, and partial financing visibility as a real underwriting risk rather than a cosmetic reporting issue.[CR021, CR022, CR023, CR024, CR025]

7.3 Regulatory, privacy, and legal-boundary risk

Cloaked’s regulatory exposure is broader than a simple consumer-software label suggests. Its privacy policy says the company can collect SSNs for monitoring services and KYC-style financial data for Cloaked Pay. It also names processors such as Plaid, PayPal, Stripe, and PureVPN-linked services, and it openly says some user information may be disclosed to data-broker sites when customers elect deletion. That architecture is understandable for the service model, but it means the company’s “privacy product” is itself a handler and router of sensitive data across multiple counterparties. FTC privacy-and-security guidance, California’s CCPA, and financial/privacy regimes such as GLBA create a real compliance stack around disclosure, access, deletion, and vendor controls. Cloaked is not ignoring this. Its trust and enterprise pages advertise SOC 2 Type 2, ISO 27001, ISO 27701, and PCI compliance, and the site repeatedly limits product scope with an explicit FCRA disclaimer. Those are meaningful mitigations. But the legal documents also cap what the product promises: Cloaked says deletion may not work on all sites, dark-web monitoring cannot find everything, and services can be changed or restricted at its discretion. That leaves a residual risk that user expectations, marketing copy, and actual legal scope diverge under stress. As Cloaked adds eSIM, payments, AI agents, and enterprise workflows, the key regulatory question is not whether the privacy market is important; it is whether the compliance program is scaling as fast as the feature surface.[CR011, CR012, CR013, CR014, CR015, CR016]

7.4 Competition, channel concentration, and partner dependency

Cloaked’s category narrative is compelling, but independent market framing is not yet on its side. Multiple 2026 rankings highlight Incogni, Optery, DeleteMe, and Aura as the reference points for data removal or all-in-one protection. Security.org puts Incogni first, while State of Surveillance prefers Optery for breadth and DeleteMe for track record; CNBC Select’s roundup likewise centers competing brands. Independent and competitor reviews then attack Cloaked from different angles: Aura argues the suite is feature-thin relative to full identity-protection products, PCMag says a similar bundle can be had for less through IronVest, and Cape’s review highlights support-model concerns. The resulting risk is not that Cloaked has no product advantage, but that independent buyers can still rationally choose broader coverage, cheaper pricing, human-guided service, or stronger credit-monitoring elsewhere. Channel and dependency risk deepen the picture. Public enterprise proof is concentrated in a narrow set of named examples, especially the Chicago Cubs and NFLPA-linked narrative. Distribution is also meaningfully app-platform and partner dependent: Apple and Google are key consumer surfaces, while deletion, payments, VPN, and identity workflows each rely on outside counterparties. That is manageable if support and operations scale. If not, a company trying to sell prevention, cleanup, payments, AI, and enterprise in one bundle could end up stretched across too many jobs at once.[CR026, CR027, CR028, CR029, CR030, CR031]

7.5 Residual exposure, mitigation maturity, and thesis-break triggers

The risk-adjusted conclusion is that Cloaked’s top risks are executional and trust-related, not existential category risk. The external fraud problem is large and persistent: IC3 reported $16.6 billion in 2024 losses, and the ITRC still handled thousands of identity-crime cases in its 2026 trends dataset. That supports demand. But demand alone does not guarantee a durable winner. Cloaked’s disclosed mitigations — certifications, encryption, insurance, and app-store traction — reduce downside from a pure security-theater story, yet they do not eliminate the problems most visible in public evidence: complaint-driven refund friction, metric inconsistency, funding opacity, concentration of enterprise proof, and a product roadmap that keeps expanding while support complaints are still easy to find. For investors, the thesis should break not on one bad review but on operating signals that show the trust gap widening instead of narrowing. A continued rise in BBB complaints, persistent broker-coverage inconsistency across first-party pages, failure to clarify valuation and financing structure, or evidence that Call Guard harms legitimate communications at scale would each weaken the case. Conversely, if Cloaked standardizes KPI disclosure, broadens named enterprise proof, and demonstrates that support maturity is catching up to product breadth, several of these risks could compress. Today, though, the public record still supports a high residual-execution-risk view.[CR019, CR024, CR025, CR035, CR037, CR038]

7.6 Exhibits

8.1 Recommendation and price discipline

The valuation question is not whether Cloaked is interesting; it is whether the public record is strong enough to underwrite the price at which investors are actually entering. On that standard, the answer is still no. The strongest evidence is positive: Cloaked has publicly disclosed 350,000+ subscribers, more than 350,000 paying customers, a 400,000+ user community, current list pricing, a broad product bundle, and a headline $375 million Series B plus growth-financing package in March 2026. Those facts support a view that consumer privacy can be a meaningful business rather than a niche utility. But the missing variables sit directly on the valuation axis. Cloaked did not disclose its post-money valuation, did not disclose current ARR, did not disclose churn, and did not disclose gross margin or preference terms. That means the same evidence set can justify curiosity, but it cannot justify conviction on entry price. The recommendation is therefore research-more, not because the company lacks promise, but because the current public record does not yet tell investors whether the latest round was fair, stretched, or unusually attractive.[CV001, CV002, CV012, CV014, CV015, CV021]

8.2 Financing surface and the price-discovery gap

Cloaked's financing record is simultaneously impressive and incomplete. The company and its press-wire announcement both disclose a $375 million Series B raise and growth financing package in March 2026. That headline matters: it signals strong access to capital and a willingness by well-known backers to fund the next stage of expansion. But the SEC filing record does not translate the headline into a clean valuation mark. The March 2026 Form D shows a $133.2 million total offering amount and $116.7 million sold, with roughly $58.2 million of the sold amount attributable to SAFE conversions into Series B preferred stock. In other words, the publicly visible sold securities are well below the $375 million headline and part of that visible amount was not fresh cash at the moment of conversion. The 2022 Series A shows the same pattern of partial visibility: $25 million announced, $25.05 million offered, and about $20.0 million sold in the filed Form D. The practical conclusion is not that management misstated the round. The practical conclusion is that the public filing trail does not reveal the full 2026 financing stack or the post-money price, so investors should not treat the headline raise itself as proof that the current valuation is attractive.[CV001, CV003, CV004, CV005, CV006, CV007]

8.3 Traction bounds and comparable-company gravity

Public operating evidence is good enough to establish a real monetization surface, but not good enough to strike a clean late-stage multiple. Cloaked's current plans page shows individual, couple, and family price points, while official and independent reporting support a paid subscriber base above 350,000. Those two facts let an investor sketch a floor and ceiling for consumer recurring revenue even without direct ARR disclosure. At the same time, public comp gravity is lower than what a notional unicorn mark would require. Gen Digital, the closest scaled consumer cyber-safety bundle, trades on roughly 2.7x revenue using June 2026 market cap and FY2026 revenue. Experian and TransUnion, both relevant to consumer identity protection and credit-linked monitoring, trade around 3.9x and 2.6x respectively. Okta, which is less consumer-relevant but richer as a public identity software platform, trades closer to 6.9x. A historical private premium anchor exists in 1Password's 2022 $6.8 billion valuation, but that mark belongs to a different product mix, a different funding window, and a much more clearly established software category. The comp lesson is therefore disciplined rather than absolute: Cloaked can deserve a premium only if realized ARR, enterprise mix, and retention are well above the conservative public floor and much better than the market currently sees.[CV014, CV021, CV022, CV023, CV024, CV033]

8.4 Scenario range and sensitivity

Because the post-money valuation is undisclosed, the right framework is not a single-point target but a set of scenarios anchored to public pricing evidence and public comp bands. The public evidence floor starts with 350,000 paying customers and the current individual plan prices. If every paying customer were on the annual individual plan, gross annualized consumer billings would be about $42 million. If every paying customer were on the monthly individual plan, the simple annualized equivalent is about $52.5 million. Reality could be higher because Cloaked also sells couple and family plans and says enterprise deals are closing, but the company does not disclose plan mix or enterprise contribution. That makes the scenario spread wide. In the bear case, realized ARR or billings settle around $35 million to $45 million and market tolerance stays near 5x to 6.5x, yielding roughly $180 million to $300 million. In the base case, ARR or billings rise into a $50 million to $60 million zone with 6x to 10x tolerance, supporting roughly $300 million to $600 million. In the bull case, enterprise and higher-ARPU plan mix push ARR toward $70 million to $80 million and investors pay 10x to 15x, supporting roughly $700 million to $1.2 billion. That upper band is possible, but it requires evidence the public record does not yet provide.[CV021, CV022, CV023, CV024, CV048, CV049]

8.5 Final diligence asks and kill criteria

The next diligence step should be explicitly price-sensitive. If the undisclosed post-money valuation is modest relative to the public floor and the cap table is clean, Cloaked could move into a more constructive zone quickly. If the post-money is already in the unicorn range and the term sheet contains material preference, debt-like, or dilution overhang, the underwriting case becomes much harder. The most important asks are straightforward: disclose the exact post-money and financing split; provide current ARR or annualized billings by plan and by enterprise versus consumer; show retention, churn, and gross margin; and map the liquidation stack. Those are not nice-to-haves. They determine whether public comp gravity should be applied near the low end, the high end, or not at all. The clearest thesis-break would be a disclosed valuation above roughly $1.5 billion without evidence that realized ARR is already above about $80 million and that enterprise or family-plan mix is durable. Until those facts are surfaced, the public record supports interest, but not price confidence.[CV002, CV013, CV050, CV053, CV054, CV055]

8.6 Exhibits