The file enters
Drop a PDF, Word doc, spreadsheet or web page. The file is read in this browser tab; deterministic jobs prepare no AI request.
The airlock · content-blind conversion
Convert a file.
Keep it.
A file goes in one side, its format is rebuilt inside a sealed chamber on your device, and the result comes out the other — PDF, Word, Markdown, HTML, spreadsheets and data. The plain conversions run in this browser tab and prepare no AI request. When AI is needed, the app prepares a cloaked copy of the document text; the Request body receipt reports the UTF-8 byte length of the JSON body this browser posted to the same-origin relay and what the scan detected.
On-device conversion · request body receipts · runs on CloakAPI
Convert a file
Drop a file into the airlock
or browse — PDF, Word, Markdown, HTML, text, CSV, TSV, JSON, Excel · up to 15 MB
Egress monitor NO THIRD-PARTY REQUESTS OBSERVED
- On-device
- 0
- Gateway
- 0
- Third-party
- 0
Why a chamber?
Format conversion runs in this browser tab. For AI-assisted work, the app prepares cloaked document text for relay. The meter above shows the request activity it observes by destination — compare it with your browser's Network panel.
Read the privacy model →How the airlock works
The chamber seals
The format is rebuilt on your device. On-device detectors check for emails, phone numbers, dates of birth, cards, IBANs, passports, national and company IDs, IP addresses, postcodes, places and person names; a multilingual model also looks for uncommon and non-Latin-script names. Detection is best-effort, so missed values can remain as written. For AI-assisted jobs, detected values are swapped to surrogates before document text is prepared for relay. You can still send while the name model is missing. Quick check replaces values it recognises; some names may be sent as written.
The result leaves
Download the converted file. The Request body receipt shows scan results and the UTF-8 byte length of the JSON body this browser posted to the same-origin relay; it excludes HTTP headers and transport bytes and does not measure bytes received by the gateway.
This page reviews the prepared request and checks that it uses an approved privacy engine before relay. Our server sends the exact request to the CloakAPI gateway for a check before forwarding it to the AI service; that check does not prove that a caller tokenised the text on-device. Known limit in Release 1: a caller on this same origin can bypass this page and submit text without client-side tokenisation.
Conversions on your device
These all run deterministically in the browser — free and on your device. Layout-aware and summarising conversions add an AI step that relays a cloaked copy of the document text, with every detected identifier replaced by a surrogate.
PDF Markdown · Text · HTML · Word
Word (DOCX) Markdown · Text · HTML · PDF
Markdown / HTML Each other · Text · Word · PDF
CSV / TSV JSON · Excel · Markdown · HTML
JSON CSV · Excel · Markdown · HTML
Excel (XLSX) CSV · JSON · Markdown · HTML