Detected values are replaced on your device. Here's how.
No hand-waving. This page is the whole mechanism — including the parts we can't promise — so you can decide whether it's right for your document.
- On your device
Detection & cloaking
A WebAssembly tokeniser and a multilingual name model run in your tab. They look for names, emails, phones, cards, IBANs, national IDs and IPs, then replace the values they detect with realistic stand-ins. A value the detector misses may remain as written. This step sends none of your text; its only network use is downloading the detection models from this site.
- Leaves your device
Cloaked-text relay
The reviewed text is sent to a translation model through CloakAPI. Values the engine detects are replaced on your device, and the map back to the original values stays there. A value the engine misses may remain as written, so review the request text before sending.
- Back on your device
Un-cloak & receipt
The translation result can still carry the stand-ins. cloak-translate maps matching values back locally, then signs a content-free receipt: category counts, the engine's identity, and the SHA-256 of the reviewed cloaked text. That hash is not the serialized request or a measurement of total network egress. The receipt records that the cloaking pipeline ran for that send; it does not measure what the detector missed. A value the engine did not flag — for example, a person name outside its dictionary, a single-word company name or a reference number in an unfamiliar format — may travel as written.
What is guaranteed
- A strict Content-Security-Policy hard-limits every network connection to this origin, the CloakAPI gateway (
api.cloakapi.io) and your CloakAPI account (app.cloakapi.io) — your browser enforces that list for this page. - The cloaking step runs before any relay and sends none of your text (it only downloads its models). The relay is fail-closed: if it can't obtain the privacy proof, nothing is sent.
- The reviewed text is sent for translation with detected values replaced; a value the detector missed may remain as written. The re-identification map stays in your browser's memory.
- Every translation can mint an offline-verifiable receipt you (or a recipient) can check without trusting us.
What we don't claim
- Detection is best-effort. An unusual identifier the models don't recognise stays in the text; review the request before translating. The preview does not measure egress bytes.
- Surrogates are realistic people/values, but not always from the same country as the original. They preserve fluency and context; strict same-nationality matching is an active improvement.
- If a translation model rewrites a surrogate (e.g. transliterates a name), that altered token simply stays as a safe placeholder in the output rather than being mapped back to a real value.
- The translation is performed by a third-party model through the gateway and is billed. It receives the reviewed request text: detected values have been replaced, while a missed value may remain as written.
Verify a receipt
Paste any cloak-translate receipt JSON to check its signature offline. This runs the same on-device verification a recipient would — no server involved.
Where a receipt comes from: after you send something to the AI, a receipt appears with the answer, and its Copy button puts the receipt JSON on your clipboard. Paste it into the box below. "Verify signature" stays off until the box has text in it, so if you haven't sent anything yet you won't have a receipt to check.