Cloudflare
- The documents do not say whether your data trains AI.
- Your data is used for personalized ads, including by third-party ad companies.
- Data is shared with partners and affiliates; you can opt out.
- The documents do not say who can read your content.
They collect account, logs, and network data; say they do not sell it, but share for ads with opt-outs.
Agent Trust Hub uses AI and may make mistakes. Review reports and confirm their contents before relying on them.
Collected
Account and payment info, website logs, cookies, and network and traffic data from sites that use Cloudflare.
Read the exact line
Privacy policy
“The information processed may include but is not limited to IP addresses, traffic routing data, system configuration information, and other information about traffic to and from Customers’ websites”
Training
They run and improve the service, send marketing, and use cookies for interest-based ads.
Read the exact line
Privacy policy
“We may also use cookies and similar technologies to provide you advertising on third-party sites based upon your browsing activities and interests.”
Sharing
They say they do not sell data, but share with vendors, partners, and ad companies, with some opt-outs.
Read the exact line
Privacy policy
“We will not sell or rent your personal information. We will only share or otherwise disclose your personal information as necessary to provide our Services”
Kept
They keep it as long as they need for business or law; 1.1.1.1 query data is mostly stored 25 hours.
Read the exact line
Privacy policy
“We store your personal information for a period of time that is consistent with the business purposes set forth in Section 3 of this policy or as long as needed to fulfill and comply with legal obligations.”
Controls
Email sar@cloudflare.com for access or deletion; cookie and ad-sharing opt-outs are in the site footer.
Read the exact line
Privacy policy
“You may email us at sar@cloudflare.com with any Rights Request, and we will respond within thirty (30) days.”
Fine print
They promise notice of big privacy changes; Always Online is as-is with no , and under-18s are not allowed.
Read the exact line
Privacy policy
“If we make changes to this Policy that we believe materially impact the privacy of your personal information, we will promptly provide notice of any such changes”
Expand “Read the exact line” to see the source alongside the explanation.
What you can turn off
The controls and opt-outs their own documents describe, and where they say to find them.
Opt out of cookie and interest-based ads
Cookie Preferences or Your Privacy Choices link in the cloudflare.com footer
Opt out of email sharing with marketing partners
Email sar@cloudflare.com
Request access, correction, or deletion
Email sar@cloudflare.com (account holders can also edit profile at Cloudflare.com)
Unsubscribe from commercial email
Unsubscribe link in emails, account settings, or unsubscribe@cloudflare.com
If a switch is not where they say, the deletion request above still applies.
Line by line
The lines that matter most, worst first.
They can track how you use their site and show ads about you on other sites.
Read the exact line
Privacy policy
“We may also use cookies and similar technologies to provide you advertising on third-party sites based upon your browsing activities and interests.”
For example, visiting their pricing page could later show Cloudflare ads on another website.
Even though they say they do not sell data for money, ad-tech sharing can still count as a sale in California.
Read the exact line
Privacy policy
“Making Personal Information (such as online identifiers or browsing activity) available to these companies may be considered a “sale” or “sharing” of your Personal Information under the .”
For example, a California user may need to use Your Privacy Choices to stop that sharing.
If a site uses Cloudflare, your visit can send IP and traffic details through Cloudflare.
Read the exact line
Privacy policy
“The information processed may include but is not limited to IP addresses, traffic routing data, system configuration information, and other information about traffic to and from Customers’ websites, devices, applications, and/or networks.”
For example, opening a blog that sits behind Cloudflare can log your IP with them.
If Always Online fails or serves the wrong archive copy, they say they owe you nothing.
Read the exact line
Terms of service
“IN NO EVENT WILL CLOUDFLARE BE TO YOU OR ANY THIRD PARTY FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES ARISING OUT OF OR RELATING TO YOUR ACCESS TO OR USE OF, OR YOUR INABILITY TO ACCESS OR USE, ALWAYS ONLINE”
For example, if the Wayback copy is outdated while your site is down, you cannot recover losses from them under this clause.
Turning on Always Online sends site URLs to a third party they do not control.
Read the exact line
Terms of service
“By enabling Always Online on your Zone, you authorize Cloudflare to share your Zone’s hostname and frequently-visited URLs with the Internet Archive”
For example, popular pages on your site can be archived by the Internet Archive even if you later change them.
There is no short, fixed delete-by date for most personal data.
Read the exact line
Privacy policy
“We store your personal information for a period of time that is consistent with the business purposes set forth in Section 3 of this policy or as long as needed to fulfill and comply with legal obligations.”
For example, contact details for an old account may stay until they decide the business need is over.
They say kids under 18 should not use this, and they will delete data if they learn someone is under 18.
Read the exact line
Privacy policy
“Cloudflare’s Websites and Services are not intended for, nor designed to attract, individuals under the age of eighteen.”
For example, a 16-year-old who signs up is not supposed to have an account.
They promise not to sell or rent your personal information for money.
Read the exact line
Privacy policy
“We will not sell or rent your personal information.”
For example, they say they will not rent your email list to another company.
They say they use encryption and other security steps, but they do not spell out audits here.
Read the exact line
Privacy policy
“We have put in place appropriate physical, technical and administrative measures to safeguard and secure your information, and we make use of privacy-enhancing technologies such as encryption.”
For example, they claim stored information is protected with encryption.
The public 1.1.1.1 DNS resolver is designed not to keep personal query logs long.
Read the exact line
Privacy policy
“Our 1.1.1.1 resolver service does not log personal information, and the bulk of the limited non-personally identifiable query data is only stored for 25 hours.”
For example, a DNS lookup through 1.1.1.1 is mostly gone after about a day.
Words to know
Legal words from the lines above, in plain English.
- cookies
- Small files a website saves on your device so it can recognise you and remember what you did. For example, a cookie keeps you logged in and can also tell an ad company which sites you visited.
- third parties
- Any company or person other than you and the app, such as advertisers, partners or analytics firms. For example, an analytics company that receives a record of every screen you tap is a third party.
- sell or share
- Under California law, selling means passing your data to others for money or other value; sharing means passing it on for targeted ads. For example, letting an ad network use your browsing history in return for ad space counts as a sale.
- personal data
- Any information that is about you or can be linked to you, from your name to your phone's ID. For example, your email, your IP address and the list of apps on your phone are all personal data.
- CCPA
- California's privacy law, which gives residents the right to see, delete and stop the sale of their data. For example, a Californian can ask the app to stop selling their data and it must comply.
- limitation of liability
- A cap on what the company will ever pay you if something goes wrong, often only what you paid in the last year. For example, if a leak of your data costs you thousands, the most you may get back is a month's subscription fee.
How we got here · grade D · score 38/100 · 15 of 15 policy answers backed by a verified quote · 7 not stated
What does the app collect beyond what it needs to work?
They collect account and payment details plus logs, IPs, cookies, device/system info, and network traffic data.
Does it record your voice, face or body, and what happens to that?
Not stated in the documents.
Are your chats and uploads used to train AI models, and is that off by default?
Not stated in the documents.
Can employees or contractors read your conversations, and when?
Not stated in the documents.
Are you profiled or tracked for advertising?
They use cookies and marketing partners for interest-based ads on third-party sites, with opt-outs.
Do they sell or share your data, and can you opt out?
They say they do not sell or rent data, but share with providers, resellers, and ad partners; California users can opt out of sale/sharing.
What rights do they take over what you type and what the AI makes?
Not stated in the documents.
How long do they keep your data after you delete it, and can you delete it in the app?
Deletion is by rights request email, not a stated in-app 30- or 90-day wipe; they keep data for business and legal needs.
Does it build a lasting memory or profile of you, and can you see, edit or turn it off?
Not stated in the documents.
Do they commit to basic security, and have they leaked data?
They describe encryption and physical, technical, and administrative safeguards, plus privacy-framework certifications.
Is there a real age gate, and are teens protected?
They say the service is not for under-18s and they will delete if they learn someone is under 18, with no age-check process described.
Will they tell you when the rules change, and is the policy specific?
They say they will notice material privacy changes and post an effective date, but retention and some purposes stay general. The privacy page itself has no date in what we received.
Can they close your account without warning, and can you get your data out first?
Not stated in the documents.
If something goes wrong, who pays?
Always Online is as-is with a very broad no-damages clause; the full master agreement is not in these documents.
Do subscriptions renew on their own, and can you get a refund?
Not stated in the documents.
The privacy policy is 6,610 words at a college graduate level (Flesch reading ease 31); the terms are 457 words at a professional or legal expert level.
