Privacy and processing
Know where your document goes.
PromptCloak replaces detected sensitive details with consistent decoys before your chosen AI receives the request. Your Mac and the web app prepare that request in different places.
Mac app
Local text processing
- Your originalDocument text is extracted on your Mac.
- Prepare decoysThe local engine detects sensitive terms and replaces them on your Mac.
- Ask your AIThe cloaked request travels through the PromptCloak relay and Venice to your selected reply provider.
- Restore the answerThe app replaces known decoys locally. Originals and mappings stay on your Mac.
You can inspect replacements before sending by turning on Strict review. Images and audio are unavailable on desktop until local processing is supported.
Web and mobile
Venice private scrubbing over HTTPS
- Your originalOriginal prompt and document text reach the PromptCloak server over HTTPS.
- Prepare decoysPromptCloak sends original text to a Venice private model to find sensitive terms and prepare replacements.
- Ask your AIAfter optional review, your selected reply model receives the cloaked request through Venice.
- Restore the answerYour browser restores known decoys. The PromptCloak server also receives the mappings used for preparation.
This route applies to regular, Pro and mobile web. Some formats are parsed in your browser; other files upload to PromptCloak for parsing. Private scrubbing uses HTTPS and the provider's privacy policy, without end-to-end enclave encryption or a TEE dependency.
Images on the web
Separate, confirmed upload
- Confirm the uploadWith your confirmation, the raw image reaches PromptCloak and Venice's image detection service.
- Prepare the imageDetected regions are pixelated. Other identifying details may remain.
- Review the resultCheck the prepared image before including it in a request to a reply model.
- Send the requestYour selected model receives the prepared image and cloaked prompt.
Image processing is not end-to-end encrypted. Detection and pixelation can miss details. Audio is currently unavailable.
Review is your choice
Strict review is optional and off by default. Turn it on in Settings or the composer to inspect replacements and the text prepared for your reply model before sending. Your choice is remembered in this browser or installation.
On the web, review happens after your original reaches PromptCloak and the scrub service. A privacy receipt shows the reply request; it is not a record of every upstream processing step.
Detection can miss information, and retained context may still identify a person or document. Cloaking is not a guarantee of anonymity.
What private scrubbing means
The web service uses Venice private models and automatically tries another tested private scrubber if one fails. Venice states that its private service does not retain prompts or responses. Original text is still processed by PromptCloak and Venice.
GPT and Claude remain available for cloaked replies through Venice, under the selected provider's applicable processing terms. A shared provider account does not make individual requests untraceable.
Scrubbing is on by default. Turning it off in the composer is an explicit per-conversation choice: those messages, documents and images are sent as written, are labelled “Scrubbing off” in the conversation, and are never reverse-substituted.
What is retained
PromptCloak does not store document or conversation backups on its servers. In-progress jobs and results use bounded memory and expire within 24 hours plus the cleanup interval; a server restart loses them. License, payment and usage metadata are stored separately.
Your browser or desktop app can retain conversation history, originals, mappings and drafts locally. Web storage is not encrypted by PromptCloak at rest. The desktop encrypts saved records using a key held in the Mac Keychain; older records are migrated when read. This does not protect data from an already compromised, unlocked app.
Optional local review logs are separate plaintext files and are off by default. Regular web, Pro and desktop use separate storage origins; your saved history does not automatically follow you between them.
Understand the restored answer
Restoration replaces known decoys. New totals, reformatted values or references invented by a model may not restore correctly. Check calculations against your original document before relying on an answer.
Spending habits, Subscription audit, Fee hunter, Medical bill audit and Insurance coverage gaps keep original monetary amounts for analysis. Names and identifiers are still cloaked. Other shortcuts and new ordinary conversations use the default monetary cloaking policy.
Availability and support
PromptCloak is a controlled beta. Desktop releases target Apple Silicon macOS 14 or newer. Signing and notarization status are release-specific. If extraction coverage is incomplete, review the warning and use a supported text export before sending.
Updated September 2026. Find this installation's build and processing mode in Settings.