What happens on your device
When you paste a CV, a WebAssembly detection engine — shipped inside this page, running in
your tab — finds the identifying values: names (a multilingual model covers Latin,
Cyrillic, Arabic, Devanagari, CJK and more), emails, phones, postal addresses, birth
dates, national IDs, IBANs and payment cards. Each identity value is swapped for a
realistic, locale- and type-matched stand-in: a Norwegian name becomes another Norwegian
name, an address another address, so the document still reads like a real CV and the
review stays useful. The mapping table — stand-in back to real value — exists only in
this tab's memory.
What happens to cards and secrets
Payment-card numbers, account credentials and similar secrets don't get realistic
stand-ins — they get locked: replaced with opaque, digit-free markers
that carry no information and cannot be reversed by anyone, including us. A CV that
happens to contain a card number is still fully reviewable — the audition proceeds with
the card sealed shut. It is never sent raw, and it is never "revealed" in any view of the
result.
What actually leaves the browser
One request, to api.cloakapi.io: the stand-in-bearing text plus
a cryptographic pre-tokenisation proof. The CloakAPI gateway is content-blind — it
forwards the stand-in document to the reviewing model and bills the tokens; it has no
mechanism to reverse the stand-ins because the map never leaves your tab. The reply comes
back carrying the same stand-ins and is un-cloaked on your device. Use the "preview what leaves" toggle on the stage to read the exact egress body before
you send anything.
What is enforced, not promised
This page ships a Content-Security-Policy whose connect-src allows exactly three destinations: this origin, api.cloakapi.io and app.cloakapi.io. The browser itself refuses any other
connection — an analytics beacon or a third-party call is technically impossible, not
merely avoided. The live monitor below counts every request this session; the third-party
column must read zero, and you can verify it against your own Network panel.
Egress monitor 0 raw-identity bytes
- On-device
- 0
- Gateway relay
- 0stand-ins
- Third-party
- 0
The receipt
After every audition, the engine signs a device receipt (ECDSA P-256): how many
identities were curtained, which categories, the SHA-256 of the exact stand-in bytes that
egressed, the engine's version and hash, and the claim raw_bytes_egressed: 0. It is content-free — it names no value
it curtained — and verifies offline, so you can prove the blind audition happened without
trusting us.
What we don't store
cloak-cv has no server of its own — these pages are static files. Your CV, your job ads
and your saved projects live in this browser's local storage and nowhere else; deleting a
project deletes the only copy that ever existed. Your CloakAPI key is stored in this
browser and sent only to the gateway as a Bearer token. There are no analytics, no
cookies, no tracking pixels — the CSP above makes that checkable rather than a promise.
The honest limits
Detection is strong, not perfect. Structured values (emails, phones,
cards, IBANs) are caught deterministically; names are best-effort — an unusual name, a
nickname or a rare script can slip through. That's why the casting sheet shows you every
swap before anything is sent: check it.
Cloaked is not anonymous. The free text of a CV — a rare job title at a
small company, a one-of-a-kind project — can itself identify you even with every name
swapped. Stand-in text is still personal data in the GDPR sense while you hold the map.
cloak-cv strengthens a data-minimisation posture; it does not make a CV legally anonymous,
and we won't tell you otherwise.
The relayed model sees the stand-in document. Content-blind means the
gateway and model never see your identity — not that your document's substance stays on
the device. The substance is exactly what you're asking to have judged.