ON-DEVICE DOCUMENT REDACTION

Redaction,
with a receipt.

Lay a sensitive document on the table. The detector suggests text to redact; you review those suggestions and can add redactions yourself. The detector may miss sensitive details. The app then seals the document and issues an on-device receipt about the processing steps it ran.

No “finds every name” promises. The detector may flag standard PII; review its suggestions and add redactions yourself. A missed item can remain. The receipt records the counts, categories and hashes of what was sealed.

OBSERVED ACTIVITY LIVE page resource timings and fetch, XHR, beacon attempts

0 other-origin response transfer bytes

0 off-origin requests · 0 same-origin sends · 0 same-origin resource entries

“Sends” counts same-origin POST, PUT, PATCH, DELETE and beacon attempts. The byte readout uses browser-reported response transfer sizes for other-origin resource timings, not request-body bytes. It does not observe WebSockets or worker requests. Open the browser’s Network panel to inspect individual requests.

⌥ Open your browser’s Network panel before redaction and inspect the requests. On first use, the page downloads its on-device name models from this site (about 181 MB for Level 2, plus about 176 MB if Level 3 loads). The live meter counts browser-reported response transfer sizes for other-origin resources and same-origin body-method attempts; it does not inspect request bodies.

THE EXAMINATION TABLE

Lay a document on the table

Drag it here, or . It is read in this browser tab — it runs on this device without a relay.

.txt.md.csv.json.html .pdf .docx — soon

Multilingual name detection RECOMMENDED On-device · ~181 MB one-time download, cached · finds names in non-Latin scripts (Cyrillic, CJK, Arabic, Devanagari, Greek, Hebrew, Thai and more) by context. The model runs in this tab; it does not call a remote AI model. The built-in Latin detector stays on. On by default. It loads the first time you redact a document.

THE SELF-REFUTING PITCH

Many redaction tools ask you to upload the sensitive file first.

To remove the secret parts, they first take a copy of the whole thing onto their servers. You have to trust a policy. This page extracts, detects, redacts and signs in your browser tab. It also requests application assets and on-device models from this site. Open your browser’s Network panel to inspect request methods, destinations and bodies.

Everyone else your file → their server → redacted copy

cloak-redact your file → stays here → redacted copy

CHAIN OF CUSTODY

Four redaction steps run in this browser tab.

Detect

A WASM engine reads the text and finds names, emails, phones, cards and IDs — in the tab, with no call to a remote AI model.

Review

You see every candidate and decide. Reveal a false positive, or select any missed text to redact it yourself. Live secrets stay locked.

Seal

Redactions stamp into place. Every value you keep redacted becomes a marker such as [REDACTED-PERSON] in the file you download — the same bars you see on the board.

Prove

A device key signs a chain-of-custody receipt — counts, categories, hashes, the engine that ran and which detection levels ran. It verifies offline.

PAGE ACTIVITY, MEASURED

See the measured activity.

The meter uses main-page resource timings and fetch, XHR and beacon attempts. It reports browser-reported response transfer sizes for other-origin resource timings, same-origin body-method attempts, and same-origin resource loads. It does not inspect request bodies or observe WebSockets or worker requests. Open the browser’s Network panel to inspect individual requests. On first use, this page downloads its on-device name models from this site.

FOR THE PEOPLE WHO HANDLE THE HARD DOCUMENTS

Compliance, legal, HR, journalism, healthcare.

Three free documents a day, no account. Unlimited from $12/month — same table, same on-device workflow.

See plans →