Last updated: April 24, 2025
We have updated our April 24, 2025, Application Privacy Policy to add contact information about our entities in India and Sweden.
This Application Privacy Policy (“Application Privacy Policy”) outlines the information that Cloudflare gathers, how we use that information, and the options you have to access, correct, or delete such information when you use the Cloudflare Application(s). As used in this Application Privacy Policy, “Cloudflare,” “Us” or “We” refers to Cloudflare, Inc. and its affiliates as listed at the end of this policy. Capitalized terms used but not defined herein have the meanings ascribed to them in the Application Terms of Service.
This Application Privacy Policy does not apply to your use of the Application as part of Cloudflare Zero Trust, in which case the Cloudflare Privacy Policy applies.
1. Scope of Policy
Our mission to help build a better Internet is rooted in the importance we place on establishing trust with the Internet community globally. To earn and maintain that trust, we commit to communicating transparently, providing security, and protecting the privacy of data on our systems.
This Policy only applies to Cloudflare’s collection, use, and disclosure of personal information in connection with the use of the Cloudflare Application(s). This Policy does not apply to Cloudflare’s collection, use, and disclosure of personal information through the Application when the Application is used as part of a Cloudflare Zero Trust account, as described in more detail in Section 3.
2. Information We Collect
We only collect and store the minimum amount of data we believe is required to operate and improve the Application. There are three categories of data that we collect: Account Data, Operational Data, and DNS Resolver Information as described more fully below. Your Account Data and Operational Data are pseudonymized. Your DNS Resolver Information is anonymized at our edge data centers.
We do not collect your name, phone number, or credit card information (or records of any payments collected by the applicable App Store). The only information we receive from the applicable App Store is a limited amount of information that we need to confirm your subscription for a Service. We do not receive from the App Store any of your personal data or other information about your App Store account. We only receive your email address (and name, if you voluntarily provide it) if you have decided to give us feedback and/or report bugs.
We promise to keep your personal information personal and private. We will not sell or rent your personal information to anyone. We will not share or otherwise disclose your personal information except as necessary to provide our services or as otherwise described in this Application Privacy Policy without first providing you with notice and the opportunity to consent.
2.1 Account Data
When you install the Application on your device, create or update your account, sign up for a Paid Application Service, or participate in one of our referral programs, we collect and store the “Account Data ” described below, depending on your use of the Application.
Account Data
2.2 Operational Data
Cloudflare also collects and stores “Operational Data” when you connect to our network. This data is required to operate and improve our Application.
Operational Data
2.3 DNS Resolver Information
We collect limited DNS query data that is sent to the 1.1.1.1 Public DNS resolver when you have the Application enabled on your device. The DNS query data that we retain does not contain your IP addresses or personal information, and the bulk of the data is only stored for 24 hours. You can learn more about our 1.1.1.1 Public DNS Resolver commitment to privacy here.
3. Cloudflare Zero Trust
The Application may be used as part of the Cloudflare Zero Trust offerings to which you or your organization may subscribe. You understand that when your device is in Cloudflare Zero Trust mode, information we collect about your use of the Application and your Internet activity will be associated with your Cloudflare Zero Trust identity (e.g., work email address), and Cloudflare will process your personal data on behalf of the Cloudflare Zero Trust organization that you have associated with your account. All information provided by you or resulting from your use of the Application as part of Cloudflare Zero Trust services to which you or your organization subscribe is collected, used, maintained, shared, and destroyed in accordance with the Cloudflare Privacy Policy, available here, and this Application Privacy Policy will no longer apply.
You further understand that when Cloudflare Zero Trust is enabled in the Application, Cloudflare may be able to associate your Cloudflare Zero Trust account information with your other use of the Application for up to 24 hours from when you enable Cloudflare Zero Trust.
4. How We Use Information We Collect
Cloudflare only processes personal information in a way that is compatible with and relevant for the purpose for which it was collected or authorized. We use the information we collect, as described in Section 2 to operate and improve the Application, such as to assist us in our debugging efforts if an issue arises. We may also use the information we collect to comply with legal obligations as well as to investigate and prevent violations of the Application Terms of Service. We will not combine the information collected from DNS queries with any other Cloudflare or third party data in any way that can be used to identify individual end users. Learn more.
5. Retention
We store your personal data only as long as is necessary to provide our Application and the associated services, pursue legitimate interests, and comply with applicable laws. Your Account Data and Operational Data will be stored for no longer than two years after your last use of the Application. Information associated with feedback and bug reports may be retained longer as needed.
6. Information Sharing
We work with other companies who help us run our business (“Service Providers”). These companies provide services to help us operate and improve the Application, including assisting with debugging and crash analytics. These Service Providers may only process personal information pursuant to our instructions and in compliance both with this Application Privacy Policy, Cloudflare’s Privacy Policy and other applicable confidentiality and security measures and regulations.
Specifically, we do not permit our Service Providers to sell any personal information we share with them, or to use any personal information we share with them for their own marketing purposes or for any other purpose than to perform the services they provide to us.
In addition to sharing with Service Providers as described above, we may also share your information with others in the following circumstances:
Within the Cloudflare Group (defined for the purposes of this Application Privacy Policy as the Cloudflare entities listed at the end of this policy);
When we are required to disclose personal information to respond to subpoenas, court orders, or legal process; or in the case of an emergency to protect any person from the danger of death or serious physical injury; or to establish or exercise our legal rights or defend against legal claims. (Learn more about how we handle law enforcement requests here);
In the event of a merger, sale, change in control, or reorganization of all or part of our business;
Where we have a good-faith belief sharing is necessary to investigate, prevent, or take action regarding illegal activities, suspected fraud, situations involving potential threats to the physical safety of any person, or as otherwise required to comply with our legal obligations; or as you may otherwise consent from time to time.
Learn more about information sharing specific to the 1.1.1.1 Public DNS Resolver here.
We do not sell, rent, or share personal information with third parties as defined under the California Consumer Privacy Act of 2018 (California Civil Code Sec. 1798.100 et seq.), nor do we sell, rent, or share personal information with third parties for their direct marketing purposes, including as defined under California Civil Code Sec. 1798.83.
7. Legal Basis for Processing
If you are an individual from the European Economic Area (EEA), please note that our legal basis for collecting and using your personal information will depend on the personal information collected and the specific context in which we collect it. We normally will collect personal information from you only where: (a) we need your personal information to perform a contract with you (e.g. to deliver the services you have requested), or (b) the processing is in our legitimate interests. In some cases, we may also have a legal obligation to collect personal information from you, or may otherwise need the personal information to protect your vital interests or those of another person. We will obtain your consent where required by law. Where we rely on our legitimate interests to process your personal data, you have the right to object. If you have any questions about or need further information concerning the legal basis on which we collect and use your personal information, please contact us at privacyquestions@cloudflare.com.
8. International Information Transfers
Cloudflare is a U.S. based, global company. We primarily store your information in the United States and the European Economic Area. To facilitate our global operations, we may transfer and access such information from around the world, including from other countries in which the Cloudflare Group has operations for the purposes described in this Policy.
Whenever a Cloudflare company transfers personal information originating from one country to another Cloudflare group company or a third party service provider or partner in a different country, we will implement appropriate safeguards, consistent with the laws of the territory from which the data is exported. We describe the safeguards we implement here. If you have any questions about or need further information concerning the safeguards Cloudflare has in place to protect your personal information, please contact us at privacyquestions@cloudflare.com.
When Cloudflare transfers personal data from the EEA, Switzerland, or the United Kingdom (UK) to the United States, we rely on our certifications under the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF), and the UK Extension to the EU-U.S. DPF. Should these certifications lapse or become otherwise invalidated, Cloudflare relies on the standard contractual clauses, including supplementary measures as necessary for transfers to the United States. We also use standard contractual clauses for other international transfers from the EEA, Switzerland, or the United Kingdom.
9. Self-certification to the Data Privacy Framework
Cloudflare complies with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF as set forth by the U.S. Department of Commerce. Cloudflare has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. Cloudflare has also certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/.
In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF (together, the “DPFs”), Cloudflare commits to resolve DPF Principles-related complaints about our collection and use of your personal information. EU, UK, and Swiss individuals with inquiries or complaints regarding our handling of personal data received in reliance on the DPFs should first contact us by emailing sar@cloudflare.com or via mail to: Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, Attn: Data Protection Officer. We will respond to your inquiry within 30 days of receipt and verification of your identity.
In compliance with the DPFs, Cloudflare commits to refer unresolved complaints concerning our handling of personal information received in reliance on the DPFs to TRUSTe, an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, please visit https://feedback-form.truste.com/watchdog/request for more information or to file a complaint. The services of TRUSTe, LLC are provided at no cost to you. You have the possibility, under certain conditions, to invoke binding arbitration for complaints regarding DPF compliance not resolved by any of the other mechanisms set out in this DPF Notice or our Privacy Notice. For more information, please see Annex 1 of the DPF Principles, available here.
The Federal Trade Commission has jurisdiction over Cloudflare’s compliance with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF). We may be required to disclose personal information we receive under the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.
Cloudflare is liable for the processing of personal information it receives under the DPF Principles and subsequently transfers to a third party acting as an agent on its behalf. Cloudflare shall remain liable under the DPF Principles if its agent processes such personal information in a manner inconsistent with the DPF Principles, unless Cloudflare proves that it is not responsible for the event giving rise to the damage.
10. Data Subject Rights and Choices
In the event you elect to contact us to report an issue with the Application, to share feedback or to send console logs, we may receive limited personal data about you, such as your email address, that we retain for a limited period of time. You will have the right to access, correct, update, export, or delete your limited personal information that we retain. You may email us at SAR@cloudflare.com with any such subject access requests (“SAR”), and we will respond within thirty (30) days.
Please keep in mind that except for when you provide feedback, we don’t receive personally identifiable information from you, and we are unable to associate your identity with your Account Data or Operational Data. As a result, our ability to comply with data subject rights is limited to those circumstances in which we have your personally identifiable data.
11. Data Security, Data Integrity and Access
We take all reasonable steps to protect information we receive from you from loss, misuse or unauthorized access, disclosure, alteration, and/or destruction. We have put in place appropriate physical, technical, and administrative measures to safeguard and secure your information, and we make use of privacy-enhancing technologies such as encryption. If you have any questions about the security of your personal information, you can contact us at privacyquestions@cloudflare.com .
12. Notification of Changes
If we make changes to this Application Privacy Policy that we believe materially impact the privacy of your personal data, we will promptly provide notice of any such changes (and, where necessary, obtain consent), as well as post the updated Application Privacy Policy on this website noting the effective date of any changes.
13. Business Transactions
We may assign or transfer this Application Privacy Policy, as well as information covered by this Application Privacy Policy, in the event of a merger, sale, change in control, or reorganization of all or part of our business.
14. English Language Controls
Non-English translations of this Application Privacy Policy are provided for convenience only. In the event of any ambiguity or conflict between translations, the English version is authoritative and controls.
15. Contact Information
Cloudflare, Inc.
101 Townsend St.
San Francisco, CA 94107
Attention: Data Protection Officer
dpo@cloudflare.com
Cloudflare (Canada) Information Technology Co., Ltd.
Suite 2600, Three Bentall Centre
595 Burrard Street, P.O. Box 49314
Vancouver, BC V7X 1L3
Attention: Data Protection Officer
dpo@cloudflare.com
Cloudflare, Ltd.
County Hall/The Riverside Building
Belvedere Road
London, SE1 7PB
Attention: Data Protection Officer
dpo@cloudflare.com
Cloudflare Portugal, Unipessoal Lda.
Largo Rafael Bordalo Pinheiro 29
1200-369 Lisboa
Attention: Data Protection Officer
dpo@cloudflare.com
Cloudflare, Pte., Ltd.
182 Cecil Street #35-01
Frasers Tower, Singapore 069547
Attention: Data Protection Officer
dpo@cloudflare.com
Cloudflare Germany GmbH
Rosental 7
80331 München
Attention: Data Protection Officer
dpo@cloudflare.com
Cloudflare Australia Pty Ltd.
333 George St., 5th Floor
Sydney, NSW 2000
Attention: Data Protection Officer
dpo@cloudflare.com
Cloudflare (Beijing) Information Technology Co., Ltd.
16 South Guangshun Street
Donghuang Building 17th Floor
Chaoyang District Beijing 100015
Attention: Data Protection Officer
dpo@cloudflare.com
Cloudflare France SAS
6 place de la Madeleine
75008 Paris
Attention: Data Protection Officer
dpo@cloudflare.com
Cloudflare Netherlands B.V.
Keizersgracht 62,
1015CS Amsterdam
Attention: Data Protection Officer
dpo@cloudflare.com
Cloudflare Japan K.K.
3-1-6 Motoazabu, Minato-ku
Tokyo, 106-0046
Attention: Data Protection Officer
dpo@cloudflare.com
Cloudflare Middle East FZ-LLC
DIC 1 Internet City Road
Building 1, Ground Floor, Office 17
Jumeirah
Dubai UAE
Attention: Data Protection Officer
dpo@cloudflare.com
Cloudflare India Private Limited
No. 215 Richmond Towers, 12 Richmond Road, Richmond Town
Banglore, Bangalore, Karnataka, India, 560025
Attention: Grievance Officer
dpo@cloudflare.com
Area 1 Security, LLC
838 Walker Road Suite 21-2,
Dover, DE, 19904
Attention: Data Protection Officer
dpo@cloudflare.com
Cloudflare Mexico S. de R.L de C.V.
Bosque de Ciruelos No. 180 int. PP 101, Col. Bosque de las Lomas, Miguel Hidalgo
Ciudad de México, 11700, México
Attention: Data Protection Officer
dpo@cloudflare.com
Cloudflare Malaysia Sdn. Bhd.
Level 21, Suite 21.01, The Gardens South Tower,
Mid Valley City,
Lingkaran Syed Putra,
Kuala Lumpur
Wilayah Persekutuan
59200
Attention: Data Protection Officer
dpo@cloudflare.com
Cloudflare Capability Center (India) Private Limited
14, 1 Cross 4F
NS Halli, Gundappa Lane,
Sanjaya Nagar, R.M.V. Extension II Stage
Bangalore North, Bangalore - 560094, Karnataka, India
Attention: Grievance Officer
dpo@cloudflare.com
Cloudflare Sweden AB
c/o Setterwalls Advokatbyrå
Att: J. Johannesson
Box 1050
101 39 Stockholm
Sweden
Attention: Data Protection Officer
dpo@cloudflare.com
16. Addendum applicable to users in South Korea
You can view the addendum applicable to users in South Korea here.
Self-Serve Subscription Agreement
If you have questions about these terms or anything else about Cloudflare, please don't hesitate to contact us:
+1 (650) 319-8930
Cloudflare, Inc.
101 Townsend St,
San Francisco, CA 94107
USA