> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cloak.ag/llms.txt
> Use this file to discover all available pages before exploring further.

# FAQ

> Straight answers about custody, recovery, fees, and what Cloak can and cannot do

Honest answers, worst cases first. If your question isn't here, start with [What is Cloak?](/guide/what-is-cloak).

<AccordionGroup>
  <Accordion title="Has Cloak been audited?">
    Cloak's shield-pool program has undergone an external security assessment. The full report is being prepared for publication and will be linked here. {/* TODO(audit-url): link the published audit report */} Our full threat model — including what Cloak cannot do — is at [Security](/guide/security).
  </Accordion>

  <Accordion title="Can Cloak freeze, seize, or spend my funds?">
    No — no custodial path exists in the program. Cloak can't see your balance, can't spend it, and can't recover it. That's the design.
  </Accordion>

  <Accordion title="What happens if I lose my backup file?">
    If your browser data is still intact, nothing is lost yet — open Backup & Restore and export a new file now. If you clear your browser data with no backup file, your private balance is gone — not seized, gone. Cloak cannot recover it, and neither can anyone else; that's the proof that we never had your funds.
  </Accordion>

  <Accordion title="What happens if I lose my wallet?">
    Your funds are safe as long as you still have your browser data or your backup file — any connected wallet can spend a restored private balance. The wallet is not a recovery root; its signature is used for sign-in and encryption only. What you do lose is the viewing key tied to the old wallet, which means compliance-history access for that older activity.
  </Accordion>

  <Accordion title="Can Cloak recover my balance for me?">
    No. Your private balance lives encrypted in your UTXOs, on your device; Cloak's servers never hold UTXO secrets, so there is nothing on our side to restore from. Your backup file is the money — it is the only recovery artifact, and it restores your balance on any device via Backup & Restore.
  </Accordion>

  <Accordion title="What does a chain-watcher actually see?">
    Deposits into the pool and withdrawals out of it — never the link between them. Shielded pools are like sealed envelopes in a public mailbox: everyone sees mail, not what's inside. Other pool users see nothing about you, and each withdrawal is validated by a zero-knowledge proof without revealing which deposit funded it.
  </Accordion>

  <Accordion title="Is using Cloak legal? How does compliance work?">
    Cloak is built to be private by default, auditable when required. Every transaction is screened against sanctions and high-risk lists via Range, our screening partner, before it broadcasts; flagged transactions are blocked with a support path. When you need to disclose — audits, tax reporting, due diligence — your viewing key produces a CSV or PDF report of your own transactions and reveals nothing about other users; see [Compliance](/guide/compliance).
  </Accordion>

  <Accordion title="What does it cost?">
    Shielding is free; sending SOL to a public address costs 0.005 SOL fixed plus 0.3%, while USDC and USDT pay 0.3% only, with no fixed fee. A private swap costs 0.005 SOL plus 0.3% of the SOL swapped, and shielded-to-shielded transfers are free at the protocol level. Fees are collected on-chain by the program — nothing else charges you; the full table is at [Fees](/guide/fees).
  </Accordion>

  <Accordion title="Why is there no fee to shield or to receive?">
    The protocol charges only when value leaves the pool, so deposits carry no protocol fee — your wallet pays normal network gas to shield, nothing more. Recipients receive the exact amount entered because the fee is added on top and deducted from the sender's private balance.
  </Accordion>

  <Accordion title="Which tokens and wallets are supported?">
    You can shield and send SOL, USDC, and USDT, each in its own shielded pool; swaps take shielded SOL in and deliver any Jupiter-verified token out. Phantom, Solflare, Ledger, and Solana Mobile are supported, and any Wallet Standard wallet (such as Backpack) is auto-detected. Details at [Wallets & tokens](/guide/wallets-and-tokens).
  </Accordion>

  <Accordion title="Is there a minimum amount?">
    Yes for SOL: 0.01 SOL to shield and 0.01 SOL to swap. There is no protocol minimum for USDC or USDT.
  </Accordion>

  <Accordion title="Who pays the gas?">
    You do only when shielding — your wallet signs the deposit and pays normal network gas. For private sends, swaps, and withdrawals, the transaction is submitted for you: your wallet pays no gas and never appears as sender.
  </Accordion>

  <Accordion title="Can the Cloak program change?">
    The Cloak program is upgradeable. The upgrade authority is held by the Cloak team and is planned to move under a Squads multisig. We say this plainly because an upgradeable program you know about is safer than an "immutable" one that quietly isn't — upgradeability is how fixes ship.
  </Accordion>

  <Accordion title="Is my transaction private immediately?">
    Your wallet never appears as sender from the first transaction, but privacy strength grows with pool activity and time. Funds already shielded are more private than shield-and-send in one step, for example. The three habits that strengthen it are in [How Cloak works](/guide/how-it-works).
  </Accordion>
</AccordionGroup>

<Tip>
  Before you rely on any of the above: export your backup file. Your backup file is the money.
</Tip>

## Where next

<CardGroup cols={2}>
  <Card title="Security" icon="shield-halved" href="/guide/security">
    The threat model, on-chain protections, and the full "What Cloak cannot do" list.
  </Card>

  <Card title="Your private balance" icon="wallet" href="/guide/private-balance">
    How UTXOs, the backup file, and restore actually work — read before you shield.
  </Card>
</CardGroup>