Detected values are replaced on this device. Here's exactly how.
No hand-waving. This page is the whole mechanism — including the parts we can't promise — so you can decide whether it's right for your page.
- On your device
Detection & ghost ink
A WebAssembly tokeniser and a multilingual name model run entirely in your tab. They find names, emails, phones, postal addresses, cards, national IDs and IPs, and write a realistic surrogate over each in ghost ink. This step sends none of your text: its only network requests are same-origin downloads of the models and name lists — watch the inkline, which counts them.
- Leaves your device
Cloaked-text relay
The reviewed request text is sent to a writing model through the CloakAPI gateway. The gateway adds a verification value to the reviewed request. This check does not confirm that on-device cloaking ran. The relay builds an outgoing request from the reviewed text. Values the engine detects, and the map back, stay out of the request; a value it misses goes as written, which is why you should review the request before sending.
- Back on your device
Re-ink & receipt
The finished page returns still carrying the surrogates. cloak-write maps them back to your real values locally, then signs a content-free receipt: category counts, the engine's identity, and a SHA-256 digest of the reviewed text body used by the receipt code; it is not a hash of the JSON request sent to the gateway. The receipt records that the cloaking pipeline ran for that send. It does not measure how much the detector missed: text the engine did not flag — person names outside its dictionary, single-word company names, reference numbers in unfamiliar formats — went as written.
Names and numbers are swapped on your device first
- A strict Content-Security-Policy hard-limits every network connection to this origin, the CloakAPI gateway (
api.cloakapi.io) and your CloakAPI account (app.cloakapi.io) — the browser blocks this page's scripts from connecting anywhere else. - The cloaking step runs before any relay and sends none of your text; it only downloads its models and name lists from this site. The relay is fail-closed: The relay couldn't verify this request before forwarding it, so it did not send it. Try again.
- Every value the engine detects is replaced before transmission; the re-identification map stays in your browser's memory.
- What you write is not stored on this site's server. It passes the ghost-ink page on to the CloakAPI gateway relay without saving it; it also counts requests for free-tier limits and logs the gateway's error reply when a relay fails.
- Every rewrite can mint an offline-verifiable receipt you (or anyone you show it to) can check without trusting us.
What we don't claim
- Detection is best-effort. An unusual identifier the models don't recognise stays in the text; review the request before sending. The preview does not measure egress bytes.
- The prose around the names still travels. If the story itself identifies someone ("our only left-handed violinist"), the ghost ink can't hide that — write with that in mind.
- Surrogates are realistic, gender- and locale-matched where the engine can; for scripts it can't morph, it falls back to a safe neutral stand-in. They preserve fluency, not always exact nationality.
- If the writing model re-spells a surrogate, that altered token simply stays as a safe placeholder in the output rather than being mapped back to a real value.
- A third-party writing model receives a JSON request through the gateway. It contains the reviewed user text alongside the model instructions and request settings; the request is billed.
Verify a receipt
Paste any cloak-write receipt JSON to check its signature offline. This runs the same on-device verification a recipient would — no server involved.
Where a receipt comes from: after you send something to the AI, a receipt appears with the answer, and its Copy button puts the receipt JSON on your clipboard. Paste it into the box below. "Verify signature" stays off until the box has text in it, so if you haven't sent anything yet you won't have a receipt to check.