How it stays private

Audio never leaves. Here's exactly how.

No hand-waving. This page is the whole mechanism — including the parts we can't promise — so you can decide whether it's right for your meeting.

On your device
Record & transcribe

MediaRecorder captures your microphone (or you upload a file) straight into browser memory — never uploaded. A Whisper speech model (transformers.js, self-hosted, no HF hub) turns it into text in the same tab. This step makes zero network connections — watch the signal line stay flat.
Still on your device
Detection & cloaking

A WebAssembly tokeniser and a multilingual name model run entirely in your tab over the transcript. They find names, emails, phones, postal addresses, cards, national IDs, IPs and reference numbers, and write a realistic surrogate over each. Also zero network.
Leaves your device
Surrogate-only relay

Only the surrogate transcript is sent to a summary model, through the CloakAPI gateway, carrying a cryptographic pre-tokenisation proof (a MAC over the exact bytes). The gateway relays those bytes verbatim. Your audio, your real values, and the map back are never in the request.
Back on your device
Re-ink & receipt

The finished summary returns still carrying the surrogates. cloak-meet maps them back to your real values locally, then signs a content-free receipt: category counts, the engine's identity, the SHA-256 of the exact bytes that egressed, and the claims audio_bytes_egressed: 0 and raw_bytes_egressed: 0.

What is guaranteed

Audio never leaves your browser, in any form, at any point — recording, decoding and transcription all happen in this tab. There is no upload endpoint for audio at all.
A strict Content-Security-Policy hard-limits every network connection to this origin plus the CloakAPI gateway — nothing else can be contacted, by construction.
The cloaking step runs before any relay and makes no network calls. The relay is fail-closed: if it can't obtain the privacy proof, nothing is sent.
Only surrogate transcript text is ever transmitted; the re-identification map stays in your browser's memory.
Nothing you record is stored on any server of ours — there is no server behind this site, only the static files and the gateway relay.
Every summary can mint an offline-verifiable receipt you (or anyone you show it to) can check without trusting us.

Transcription accuracy depends on audio quality, accents and background noise, like any speech model. Always glance at the transcript before summarising, and edit it if something's wrong.
Detection is very good, not omniscient. An unusual identifier the models don't recognise stays in the text — always glance at the "preview what leaves" view before you run.
What's said around the names still travels. If the words themselves identify someone ("our only left-handed violinist"), cloaking can't hide that — speak with that in mind.
Surrogates are realistic, gender- and locale-matched where the engine can; for scripts it can't morph, it falls back to a safe neutral stand-in. They preserve fluency, not always exact nationality.
If the summary model re-spells a surrogate, that altered token simply stays as a safe placeholder in the output — never your real value.
The summarising itself is performed by a third-party model via the gateway. It sees the surrogate transcript, and it is billed. That's the one thing that leaves — on purpose.

Paste any cloak-meet receipt JSON to check its signature offline. This runs the same on-device verification a recipient would — no server involved.