The Cloakercoaster

Two years ago, if you’d asked me whether I wanted to build a VPN service, I would have laughed you out of the coffee shop. VPNs were by no means top of my mind!

At the time, I was an itinerant freelancer working from Seattle’s many fine caffeine houses. I performed sensitive work for my clients over untrusted (and often wide-open) wireless networks. I knew I needed a VPN but, when I shopped around, I found products that fell roughly into two camps: those that had a poor user experience, and those that were just plain sketchy. The state of the art was to download OpenVPN and a corresponding configuration file, or to manually configure third-party apps. I didn’t want more nerdingulation in my life; I knew I wouldn’t use a VPN if it wasn’t hassle-free.

At around the same time, Peter, Nick, and I wanted to start a new project together. We’d previously worked on a short-lived but failed project that proved 20% unfortunate, 80% fun. New idea in hand, it wasn’t long before we were off to the races. We quickly shipped Cloak’s MVP and sat back to let the service grow organically. With limited but promising early data, we decided to take credit cards and make a full-time go of it. Cloak 1.0 launched in January at Macworld 2013 and we’ve been cranking ever since.

All this is to say: Cloak is the very definition of a leap before you look business. We built Cloak for ourselves first and for business second. Sure, we felt that Cloak was a substantially better offering on a couple key axes. But with hindsight it’s clear that we also had no idea what the VPN market would look like or where the roller coaster would lead. It’s unsurprising, then, that several aspects of our business continue to vex. To be sure, I love the grind: every worthwhile creative or entrepreneurial endeavor spends time in the muck. This doesn’t reduce its complexity or its stress!

As a rule, users have deep misconceptions about VPNs. Well before we built Cloak, we knew there would be an education barrier. We were still surprised by its height. VPN services solve an extremely narrow set of security problems; it’s difficult to communicate the merits of their subtle, incremental improvements. Worst of all, some (nameless) competitors appear to actively mislead their customers into believing VPNs are something they’re not. We’re asked with alarming regularity whether Cloak can protect from the NSA (no), provide anonymity (no), or make it safe to access bank websites from Starbucks (it’s already safe). Taking money from customers who don’t even know why they’re using your product is a moral minefield. When we hear from deeply confused customers, we typically refund their most recent month of service and gently nudge them in a new direction.

We also entered the market with several of our own misconceptions. Cloak was designed to be a great privacy and security service; with features like OverCloak, Cloak is essentially overbuilt for any other purpose. But it’s clear now that privacy is only important to a minority of our users. The majority use VPNs to circumvent frustrating network blocks and geographic content restrictions. As shipped, Cloak 1.0 was woefully under-equipped to serve those customers. That’s why we quickly moved to add Transporter to the mix. This single feature addition radically altered our core business; in many ways, we’re still catching up. Our next round of work substantially improves both messaging and design, making it clear that we seek to satisfy both customer segments with a single, unified product.

Despite our many fumbles along the way, we’ve been lucky enough to find great customers and delight them. We’ve had the good fortune to turn Cloak into a profitable, growing business. In the short-term, we’re hard at work on Cloak 2, which addresses nearly all of our top customer requests. But as we look more broadly at the universe of privacy and security solutions, VPNs feel like a shrinking piece of the pie. These days, we’re asking ourselves how we might solve much larger and more pressing problems. What will it take to really go for the privacy jugular?