The image is read on this device. Here's what happens.
This page explains how cloak-scan handles a scan and the limits we can state about that flow.
- On your device
OCR & redaction
OCR reads the selected image in your browser. Review the extracted text and detected replacements before choosing Ask. The source image is not a file part of the text-only relay request; detector misses can remain in the reviewed text.
- Leaves your device (optional)
Cloaked-text relay
When you choose Ask, the reviewed text is sent through the app server to the CloakAPI gateway with a MAC over the serialized request bytes. That MAC does not prove that every value was detected or replaced. Detected values are represented by surrogates; anything the on-device engines miss may remain as written.
- Back on your device
Re-identify & receipt
After a successful Ask response, cloak-scan attempts to sign a receipt on this device. If signing fails, the ask can still have succeeded without a receipt. Its SHA-256 covers the reviewed user text, not the JSON request or HTTP bytes; it reports detected spans, not missed values or transferred-byte counts.
What is guaranteed
- The Content-Security-Policy connect-src directive allows this origin, api.cloakapi.io, and app.cloakapi.io. It limits destinations for connections covered by that directive; it does not inspect request bodies or measure transferred bytes.
- The request monitor counts resource-timing entries and fetch, XHR, and beacon attempts observed by this page. An attempt can fail or be blocked; the monitor is not a packet capture and does not inspect request bodies or count bytes delivered.
- The on-device engines replace values they detect; values they miss can remain as written. The review and re-identification map stay on your device.
- The app server receives the reviewed text to obtain its pre-tokenisation MAC, relay it to the gateway, and meter free-tier use.
- After a successful Ask response, the app attempts to create an offline-verifiable receipt. If signing fails, no receipt is issued even though the Ask may have succeeded.
What we don't claim
- OCR reads what a scan clearly shows, not what a person could infer. Blurry photos, unusual fonts and handwriting reduce accuracy — always check the extracted text before asking a question about it.
- Detection is best-effort. Values the on-device engines miss can remain in the request text. Review the preview before choosing Ask; it shows text and replacements, not bytes delivered over the network.
- English is the only OCR language built in; other languages are downloaded only when you choose them. PDFs aren't read — export a page as an image, or take a screenshot of it, and drop that in.
- Surrogates are realistic, gender- and locale-matched where the engine can; for scripts it can't morph, it falls back to a safe neutral stand-in.
- If the AI model re-spells a surrogate, that altered token simply stays as a safe placeholder in the output rather than being mapped back to a real value.
- When you choose Ask, the CloakAPI gateway sends the reviewed request to the third-party AI model configured for this app.
Verify a receipt
Paste any cloak-scan receipt JSON to check its signature offline. This runs the same on-device verification a recipient would — no server involved.
Where a receipt comes from: after you send something to the AI, a receipt appears with the answer, and its Copy button puts the receipt JSON on your clipboard. Paste it into the box below. "Verify signature" stays off until the box has text in it, so if you haven't sent anything yet you won't have a receipt to check.