How it stays private

The names never leave. Here's exactly how.

No hand-waving. This page is the whole mechanism — including the parts we can't promise — so you can decide whether it's right for your page.

On your device
Detection & ghost ink

A WebAssembly tokeniser and a multilingual name model run entirely in your tab. They find names, emails, phones, postal addresses, cards, national IDs, IPs and reference numbers, and write a realistic surrogate over each in ghost ink. This step makes zero network connections — watch the inkline stay flat.
Leaves your device
Surrogate-only relay

Only the ghost-ink page is sent to a writing model, through the CloakAPI gateway, carrying a cryptographic pre-tokenisation proof (a MAC over the exact bytes). The gateway relays those bytes verbatim. Your real values, and the map back, are never in the request.
Back on your device
Re-ink & receipt

The finished page returns still carrying the surrogates. cloak-write maps them back to your real values locally, then signs a content-free receipt: category counts, the engine's identity, the SHA-256 of the exact bytes that egressed, and the claim raw_bytes_egressed: 0.

What is guaranteed

A strict Content-Security-Policy hard-limits every network connection to this origin plus the CloakAPI gateway — nothing else can be contacted, by construction.
The cloaking step runs before any relay and makes no network calls. The relay is fail-closed: if it can't obtain the privacy proof, nothing is sent.
Only surrogate text is ever transmitted; the re-identification map stays in your browser's memory.
Nothing you write is stored on any server of ours — there is no server behind this site, only the static files and the gateway relay.
Every rewrite can mint an offline-verifiable receipt you (or anyone you show it to) can check without trusting us.

Detection is very good, not omniscient. An unusual identifier the models don't recognise stays in the text — always glance at the "preview what leaves" view before you run.
The prose around the names still travels. If the story itself identifies someone ("our only left-handed violinist"), the ghost ink can't hide that — write with that in mind.
Surrogates are realistic, gender- and locale-matched where the engine can; for scripts it can't morph, it falls back to a safe neutral stand-in. They preserve fluency, not always exact nationality.
If the writing model re-spells a surrogate, that altered token simply stays as a safe placeholder in the output — never your real value.
The rewriting itself is performed by a third-party model via the gateway. It sees fluent ghost-ink text, and it is billed. That's the one thing that leaves — on purpose.

Paste any cloak-write receipt JSON to check its signature offline. This runs the same on-device verification a recipient would — no server involved.