Your library stays in the tab. Here's exactly how.
No hand-waving. This page is the whole mechanism — including the parts we can't promise — so you can decide whether it's right for your documents.
- On your device
Add & extract
Adding a document reads its bytes locally and pulls out plain text — pdf.js for PDF, mammoth for Word, a plain decode for text and Markdown. The extracted text is stored in your browser's IndexedDB. The raw file stays in this browser, and this app's code does not send the file to any server.
- On your device
Seal, on ask
When you ask a question, request a summary or a redline, an on-device WebAssembly tokeniser and multilingual name model review the question and document text. They replace recognised names, emails, phones, addresses, cards and national IDs with stand-ins. Structured identifiers match by rule; free-form names depend on the on-device model, so some values can be missed and sent as written. The displayed preview shows the reviewed text, not the complete network request; the relay may make additional safety adjustments. The review step itself makes no network connections; the models it uses are downloaded from this site when the page loads (the multilingual name model is about 180 MB), and that download shows on the monitor.
- Leaves your device
Request through the gateway
When you ask, cloak-docs sends a request to the CloakAPI gateway. The on-device review replaces values it detects with stand-ins; a value it misses may be included as written. The gateway request MAC covers the serialized request bytes; it does not prove that every value was detected or replaced. The gateway forwards the request to the model. The re-identification map stays on your device.
- Back on your device
Restore & receipt
The answer returns with the stand-ins. cloak-docs maps them back to your real values locally, then issues an on-device receipt with category counts, the engine identity, the document's file name and a SHA-256 hash of the text produced by on-device review. The relay can subsequently add instructions or adjust that text, so this hash is not a hash of the complete request sent over the network. The receipt does not measure values the detector missed; those may have gone as written.
What is guaranteed
- A strict Content-Security-Policy hard-limits every network connection to this origin, the CloakAPI gateway (
api.cloakapi.io) and your CloakAPI account (app.cloakapi.io) — the browser blocks this page's scripts from connecting anywhere else. - Your library — every document you add — lives only in this browser's IndexedDB. There is no document upload endpoint in this product; a document stays in this browser until you ask a question about it. An AI request can include a value the on-device detector missed.
- The sealing step runs before any relay; it sends no text, and its only requests are same-site model and engine downloads. A gateway request MAC checks the request bytes for relay; it does not prove every value was detected or replaced. If a MAC cannot be obtained, the completion model is not called, though the gateway may have received the MAC request.
- The re-identification map stays in your browser's memory. The relay sends the reviewed request text, which can include values the engine missed as written.
- Every ask can mint an offline-verifiable receipt you (or anyone you show it to) can check without trusting us.
What we don't claim
- Detection can miss values. An unusual identifier the models do not recognise may stay in the text; review the displayed text before sending. The relay may make further safety adjustments.
- The prose around a name still travels. If the document itself identifies someone ("our only left-handed violinist"), sealing can't hide that — write with that in mind.
- Surrogates are realistic, gender- and locale-matched where the engine can; for scripts it can't morph, it falls back to a safe neutral stand-in. They preserve fluency, not always exact nationality.
- If the model re-spells a seal, that altered token simply stays as a safe placeholder in the answer rather than being mapped back to a real value.
- The request is sent to a third-party model through the gateway. The model can receive values the on-device detector missed, and its usage may be billed.
- Your library survives only in this browser's storage. Clearing site data, switching devices, or using private browsing means it's gone — there is no server backup to recover it from, by design.
Verify a receipt
Paste any cloak-docs receipt JSON to check its signature offline. This runs the same on-device verification a recipient would — no server involved.
Where a receipt comes from: after you send something to the AI, a receipt appears with the answer, and its Copy button puts the receipt JSON on your clipboard. Paste it into the box below. "Verify signature" stays off until the box has text in it, so if you haven't sent anything yet you won't have a receipt to check.