How it stays private

The names never leave. Here's exactly how.

No hand-waving. This page is the whole mechanism — including the parts we can't promise — so you can decide whether it's right for your email.

On your device
Detection & sealing

A WebAssembly tokeniser and a multilingual name model run entirely in your tab. They find names, emails, phones, postal addresses, cards, national IDs, IPs and reference numbers and frank each with a realistic surrogate. This step makes zero network connections — watch the egress monitor stay flat.
Leaves your device
Surrogate-only relay

Only the surrogate-bearing text is sent to a drafting model, through the CloakAPI gateway, carrying a cryptographic pre-tokenisation proof (a MAC over the exact bytes). The gateway relays those bytes verbatim. Your real values, and the map back, are never in the request.
Back on your device
Reseal & receipt

The draft returns still carrying the surrogates. cloak-post maps them back to your real values locally, then signs a content-free receipt: category counts, the engine's identity, the SHA-256 of the exact bytes that egressed, and the claim raw_bytes_egressed: 0.

What is guaranteed

A strict Content-Security-Policy hard-limits every network connection to this origin plus the CloakAPI gateway — nothing else can be contacted, by construction.
The cloaking step runs before any relay and makes no network calls. The relay is fail-closed: if it can't obtain the privacy proof, nothing is sent.
Only surrogate text is ever transmitted; the re-identification map stays in your browser's memory.
cloak-post never sends email. There is no SMTP, no mailbox and no address book — the finished draft is handed to you to send yourself.
Every draft can mint an offline-verifiable receipt you (or a recipient) can check without trusting us.

Detection is very good, not omniscient. An unusual identifier the models don't recognise stays in the text — always glance at the "preview what leaves" view before you seal.
Surrogates are realistic people/values, gender- and locale-matched where the engine can; for scripts it can't morph, it falls back to a safe neutral stand-in. They preserve fluency, not always exact nationality.
If a drafting model rewrites a surrogate (e.g. transliterates a name), that altered token simply stays as a safe placeholder in the output — never your real value.
The drafting itself is performed by a third-party model via the gateway. It sees fluent surrogate text, and it is billed. That's the one thing that leaves — on purpose.

Paste any cloak-post receipt JSON to check its signature offline. This runs the same on-device verification a recipient would — no server involved.