Medical letters & referrals
Photograph a letter and ask what it means — the patient's name, DOB and reference number are redacted before any AI sees the text.
On-device OCR scanner Scan it.
Scan it.
Cloak it first.
A photo of a letter, a screenshot of a form, a scanned invoice — the pages that most need reading are exactly the ones you shouldn't paste into a public AI. cloak-scan reads the page with on-device OCR, right in your browser: the image itself is never uploaded. Before anything is offered to an AI, every name, date and identifier the scan found is swapped for a realistic surrogate — a safe stand-in.
- 0 raw image bytes uploaded
- 0 raw-PII bytes egressed
- Signed on-device receipt
Drop an image here, or click to choose
PNG, JPEG, WEBP, BMP, GIF, TIFF — read entirely on your device
Or try a sample
The pages you photograph, not paste
Invoices & receipts
Scan a handwritten invoice and extract the total, dates and line items — client name and IBAN stay on your device.
Forms & ID documents
Read a filled-in form without the applicant's name, address or ID number ever reaching a model provider's logs.
Foreign-language pages
Translate a scanned letter to English — names, dates and numbers are copied verbatim, never re-guessed by the model.
The scan, in three passes
Capture — on your device
A WebAssembly OCR engine reads the text off your photo or screenshot right in the browser tab. The image itself is never uploaded, never base64-ed into a request — it simply never leaves this device.
Cloak — redaction bar lifts
A second on-device engine, plus a multilingual name model, finds every name, email, phone, address, card and reference number in the extracted text — across Latin, Cyrillic, Arabic and CJK — and swaps a realistic surrogate over each. Zero network.
Ask — surrogates only travel
If you ask a question, only the surrogate-bearing text is sent, through the CloakAPI gateway with a cryptographic pre-tokenisation proof. cloak-scan maps the answer back to your real values on-device and signs a receipt attesting 0 raw bytes ever left.