Detected values are replaced on this device. Here's exactly how.
No hand-waving. This page is the whole mechanism — including the parts we can't promise — so you can decide whether it's right for your email.
- On your device
Detection & sealing
A WebAssembly tokeniser and a multilingual name model run entirely in your tab. They look for names, emails, phones, postal addresses, cards, national IDs and IPs, and replace detected values with realistic surrogates. Detection sends no text; its requests are same-site downloads of the engine and name-model files (the larger name model is roughly 181 MB), visible in the egress monitor and your browser's Network panel.
- Leaves your device
Cloaked-text relay
The cloaked copy is sent to a drafting model through the CloakAPI gateway. The gateway verifies the request before processing it. This does not verify that the on-device privacy checks ran. Our server prepares the reviewed text for the model. The values the detector replaced, and the map back, are not in the request; anything it did not detect goes as written.
- Back on your device
Reseal & receipt
The draft returns still carrying the surrogates. cloak-post maps them back to your real values locally, then signs a content-free receipt: category counts, the engine's identity, and a SHA-256 digest of the reviewed text body used by the receipt code; it is not a hash of the JSON request sent to the gateway. The receipt records that the cloaking pipeline ran for that send. It does not measure how much the detector missed: text the engine did not flag — person names outside its dictionary, single-word company names, reference numbers in unfamiliar formats — went as written.
What is guaranteed
- A strict Content-Security-Policy hard-limits every network connection to this origin, the CloakAPI gateway (
api.cloakapi.io) and your CloakAPI account (app.cloakapi.io) — the browser blocks this page's scripts from connecting anywhere else. - The cloaking step runs on your device before any relay. The relay checks the request format and size: Our relay checks the request format and size before forwarding it. It cannot verify that the on-device privacy checks ran; values those checks miss may still be sent as written.
- Values the detector found are replaced before transmission, and the re-identification map stays in your browser's memory. Text it did not detect is transmitted as written.
- cloak-post does not send email. There is no SMTP, no mailbox and no address book — the finished draft is handed to you to send yourself.
- When on-device signing succeeds, the draft includes a content-free receipt that you or its recipient can verify offline.
What we don't claim
- Detection is best-effort. An unusual identifier the models don't recognise stays in the text; review the request before sealing. The preview does not measure egress bytes.
- Surrogates are realistic people/values, gender- and locale-matched where the engine can; for scripts it can't morph, it falls back to a safe neutral stand-in. They preserve fluency, not always exact nationality.
- If a drafting model rewrites a surrogate (e.g. transliterates a name), that altered token simply stays as a safe placeholder in the output rather than being mapped back to a real value.
- A third-party drafting model receives a JSON request through the gateway. It contains the reviewed user text alongside the prompt instructions and request settings; the request is billed.
Verify a receipt
Paste any cloak-post receipt JSON to check its signature offline. This runs the same on-device verification a recipient would — no server involved.
Where a receipt comes from: after you send something to the AI, a receipt appears with the answer, and its Copy button puts the receipt JSON on your clipboard. Paste it into the box below. "Verify signature" stays off until the box has text in it, so if you haven't sent anything yet you won't have a receipt to check.