Medical letters & referrals
Photograph a letter and ask what it means — the patient's name, DOB and reference number are redacted before any AI sees the text.
On-device OCR scanner Scan it.
Scan it.
Cloak it first.
A photo of a letter, a screenshot of a form, a scanned invoice — the pages that most need reading are exactly the ones you shouldn't paste into a public AI. cloak-scan reads the page with on-device OCR, right in your browser: the image itself is never uploaded. Before anything is offered to an AI, every name, date and identifier the scan found is swapped for a realistic surrogate — a safe stand-in.
- On-device scanning — the image stays here
- Cloaked before anything leaves
- Signed on-device receipt
Drop an image here, or click to choose
PNG, JPEG, WEBP, BMP, GIF, TIFF — read entirely on your device
Or try a sample
The pages you photograph, not paste
Invoices & receipts
Scan a handwritten invoice and extract the total, dates and line items — client name and IBAN stay on your device.
Forms & ID documents
Read a filled-in form without the applicant's name, address or ID number ever reaching a model provider's logs.
Foreign-language pages
Translate a scanned letter to English — names, dates and numbers are copied verbatim, never re-guessed by the model.
The scan, in three passes
Capture — on your device
A WebAssembly OCR engine reads the text off your photo or screenshot right in the browser tab. The image itself is never uploaded, never base64-ed into a request — it simply never leaves this device.
Cloak — redaction bar lifts
A second on-device engine, plus a multilingual name model, finds names, emails, phones, addresses and cards in the extracted text — across Latin, Cyrillic, Arabic and CJK — and swaps a realistic surrogate over each. Structured identifiers (cards, IBANs, national IDs, phones, emails, dates) match by rule; free-form names rely on the on-device model, so an unusual one can slip past — the ledger shows exactly what leaves. Zero network.
Ask — a cloaked copy travels
If you ask a question, only the surrogate-bearing text is sent, through the CloakAPI gateway with a cryptographic pre-tokenisation proof. cloak-scan maps the answer back to your real values on-device and signs a receipt carrying the raw-byte count measured on what left.