Audio is transcribed on this device. Here's exactly how.
No hand-waving. This page is the whole mechanism — including the parts we can't promise — so you can decide whether it's right for your meeting.
- On your device
Record & transcribe
MediaRecorder captures your microphone (or you upload a file) straight into browser memory — this path does not upload the recording. A Whisper speech model (transformers.js, self-hosted, no HF hub) turns it into text in the same tab. This step sends nothing: its only network traffic is the one-time download of the speech model from this site.
- Still on your device
Detection & cloaking
A WebAssembly tokeniser and a multilingual name model run in your tab over the transcript. They look for names, emails, phones, postal addresses, cards, national IDs and IPs, and replace values they detect with realistic surrogates. Detection is best-effort; missed values can remain as written, so review the request text before sending. This step sends no transcript text; model files are downloaded from this site.
- Leaves your device
Cloaked-text relay
The reviewed transcript is sent to a summary model through the CloakAPI gateway. The gateway adds a request integrity check. It does not verify that on-device checks ran. The gateway constructs and forwards a request containing the reviewed transcript. Your audio and the map back are not part of it. A final residual check can replace values that survived the review, but it is not exhaustive; values both checks miss can remain as written. Review the transcript before sending.
- Back on your device
Re-ink & receipt
The finished summary returns still carrying the surrogates. cloak-meet maps them back to your real values locally, then signs a receipt with category counts, the engine's identity and a SHA-256 digest of the reviewed message body, which includes the task instruction and transcript. That digest does not cover the full serialized request or measure values missed by the checks. Transcription runs on this device and the relay carries text only, so no audio is sent. The receipt records which cloaking layers ran for that send.
What is guaranteed
- Recording, decoding and transcription all happen in this tab. This path has no upload endpoint for audio.
- A strict Content-Security-Policy limits the connections this page can open to this origin, the CloakAPI gateway (
api.cloakapi.io) and your CloakAPI account (app.cloakapi.io). The browser blocks any other origin. - The cloaking step runs before any relay; it sends no text, and its only requests are same-site model and engine downloads. The relay is fail-closed: The relay could not verify the request, so it did not forward it. Try again.
- The summary request carries the cloaked transcript, not the re-identification map, which stays in your browser's memory. Sign-in and billing requests go to your CloakAPI account.
- Your recordings and transcripts are not stored on our server: it serves this site, handles sign-in and billing, and relays the reviewed transcript to the gateway without saving it. It also counts requests for free-tier limits and logs only a relay status and reference when a relay fails.
- A summary produces a receipt whose signature you (or anyone you show it to) can check offline on this page.
What we don't claim
- Transcription accuracy depends on audio quality, accents and background noise, like any speech model. Always glance at the transcript before summarising, and edit it if something's wrong.
- Detection is best-effort. An unusual identifier both checks miss can stay in the text; review the transcript before sending. The preview does not measure egress bytes.
- What's said around the names still travels. If the words themselves identify someone ("our only left-handed violinist"), cloaking can't hide that — speak with that in mind.
- Surrogates are realistic, gender- and locale-matched where the engine can; for scripts it can't morph, it falls back to a safe neutral stand-in. They preserve fluency, not always exact nationality.
- If the summary model re-spells a surrogate, that altered token simply stays as a safe placeholder in the output rather than being mapped back to a real value.
- The summary model is reached through the gateway and receives a request containing the reviewed transcript. A value missed by both checks can remain as written. Model usage is billed.
Verify a receipt
Paste any cloak-meet receipt JSON to check its signature offline. This runs the same on-device verification a recipient would — no server involved.
Where a receipt comes from: after you send something to the AI, a receipt appears with the answer, and its Copy button puts the receipt JSON on your clipboard. Paste it into the box below. "Verify signature" stays off until the box has text in it, so if you haven't sent anything yet you won't have a receipt to check.