Cloak on the device
Cells in the first 500 rows run through the on-device engine. The values it detects become realistic, locale-matched surrogates; detected values are replaced on this device before sending.
The glass ledger · content-blind analysis
Analyse the spreadsheet you could never paste into an AI.
Payroll, pipeline, patient lists, cap tables. cloak-sheets detects sensitive cells and swaps them for realistic surrogates on your device. Ask a question in plain English — the model writes the analysis, and the code runs locally, over your real numbers. Detected values are replaced on this device before sending; what detection covers, and what it misses →
- up to 8 cloaked rows are relayed; if the sheet has 8 or fewer rows, all its rows are included
- on-device Pyodide analysis
- measured request body receipt
The workbench
Detection and cloaking happen in this browser tab. This path relays up to 8 cloaked rows; a sheet with 8 or fewer rows contributes every row to the sample.
How it stays content-blind
Send the question and cloaked sample
The model receives the instructions, your question, column names and a handful of surrogate rows — enough to write analysis code. Detected values are replaced on this device; a value the detector misses may remain as written. The request body receipt reports the browser's JSON body byte count to the app relay. The ask is relayed through the CloakAPI gateway, billed as markup.
Run the code here
The model's Python runs in a sandboxed worker on your device — pandas and matplotlib over your real rows, with no connection to any other origin. The answer and charts render locally. The request body receipt counts the JSON body posted to the app relay; the signed device receipt separately hashes serialized cloaked messages.
Free to cloak and analyse. Pay only for the ask.
On-device cloaking and the full analysis runtime are free, forever. Natural-language analysis is billed as markup on the model — Personal $15/mo, Business $35/seat.