The names never leave. Here's exactly how.
No hand-waving. This page is the whole mechanism — including the parts we can't promise — so you can decide whether it's right for your document.
- On your device
Detection & cloaking
A WebAssembly tokeniser and a multilingual name model run entirely in your tab. They find names, emails, phones, cards, IBANs, national IDs and IPs and replace each with a realistic surrogate. This step makes zero network connections — watch the egress monitor stay flat.
- Leaves your device
Surrogate-only relay
Only the surrogate-bearing text is sent to a translation model, through the CloakAPI gateway, carrying a cryptographic pre-tokenisation proof (a MAC over the exact bytes). The gateway relays those bytes verbatim. Your real values, and the map back, are never in the request.
- Back on your device
Un-cloak & receipt
The translation returns still carrying the surrogates. cloak-translate maps them back to your real values locally, then signs a content-free receipt: category counts, the engine's identity, the SHA-256 of the exact bytes that egressed, and the claim
raw_bytes_egressed: 0.
What is guaranteed
- A strict Content-Security-Policy hard-limits every network connection to this origin plus the CloakAPI gateway — nothing else can be contacted, by construction.
- The cloaking step runs before any relay and makes no network calls. The relay is fail-closed: if it can't obtain the privacy proof, nothing is sent.
- Only surrogate text is ever transmitted; the re-identification map stays in your browser's memory.
- Every translation can mint an offline-verifiable receipt you (or a recipient) can check without trusting us.
What we don't claim
- Detection is very good, not omniscient. An unusual identifier the models don't recognise stays in the text — always glance at the "What leaves" view before you translate.
- Surrogates are realistic people/values, but not always from the same country as the original. They preserve fluency and context; strict same-nationality matching is an active improvement.
- If a translation model rewrites a surrogate (e.g. transliterates a name), that altered token simply stays as a safe placeholder in the output — never your real value.
- The translation itself is performed by a third-party model via the gateway. It sees fluent surrogate text, and it is billed. That's the one thing that leaves — on purpose.
Verify a receipt
Paste any cloak-translate receipt JSON to check its signature offline. This runs the same on-device verification a recipient would — no server involved.