Loading...

Ask AI About Your Tax Forms.
Keep Your SSN to Yourself.

CloakLM is a free, open-source desktop app that strips names, SSNs, and addresses from your PDFs on your device, then lets you chat with Claude, GPT, Gemini, or a fully offline model. W-2s, 1099s, medical bills, bank statements: the AI sees [PERSON_1], you see the real names.

Download for Mac & Windows Explore Features

Built for Document Privacy

Every feature designed around one principle: your PII never leaves your device.

Project Management

Organize Documents & Conversations

Group related PDFs into projects. Start multiple chats against the same document set, and pick exactly which docs provide context for each conversation.

  • Create, rename, and manage projects from the welcome screen
  • One-click to open a project or jump straight into a chat
  • Toggle individual documents in/out of LLM context per chat
Project management view showing document organization
Multi-Pass Redaction

Two AI Passes. Zero PII Leaks.

Pass 1 uses GLiNER + IBM Docling to scan locally in seconds. Pass 2 deploys a local Ollama LLM to catch what rule-based models miss — names in unusual formats, partial SSNs, addresses without standard suffixes.

  • GLiNER NER + regex patterns for structured PII (SSN, EIN, email, phone, address)
  • Optional deep scan with local Ollama model for contextual detection
  • Client-side safety net catches anything that slips through both passes
Redaction pipeline listing names and addresses detected by GLiNER
Review & Control

Inspect Every Redaction Before Sending

The Review Panel shows exactly what was redacted and by which pass. Accept or dismiss deep scan suggestions, manually redact additional text by selecting it, and see the raw anonymized output the LLM will receive.

  • Provenance badges: GLiNER (auto), Deep Scan (AI), Manual (you)
  • Select any text and click "Redact" to add manual redactions
  • Search the raw output to verify nothing was missed
Raw anonymized W-2 text exactly as sent to the AI, with placeholders
Secure Chat

The LLM Sees Placeholders. You See Real Names.

When the AI responds, CloakLM replaces [PERSON_1] with the real name on your screen — but the LLM never saw it. Switch between Claude, Gemini, OpenAI, or local Ollama models mid-conversation.

  • De-anonymization happens 100% on-device at render time
  • Provider badge on every response shows which model answered
  • Full conversation history with export to Markdown
Chat interface with de-anonymized AI responses
Bring Your Own Key

Your Keys, Your Models, Your Rules

Connect API keys for Claude, Gemini, or OpenAI — or run fully offline with Ollama. Keys are stored locally on your device and requests go directly to the provider you choose. No middleman server, ever.

  • Four providers: Anthropic Claude, Google Gemini, OpenAI, Ollama (local)
  • Deep Scan model picker auto-discovers installed Ollama models
  • Configurable document storage directory
Settings view with API key configuration

How CloakLM Secures Your Documents

A multi-layer pipeline ensures nothing slips through.

1

Upload & Organize

Drop PDFs into a quick chat or organize them into projects for ongoing work.

→
2

Multi-Pass Redaction

GLiNER + regex (instant), then optional local LLM deep scan for contextual PII.

→
3

Review & Approve

Inspect every redaction. Accept, dismiss, or manually add more before sending.

→
4

Secure Chat

Anonymized text goes to the LLM. Responses are de-anonymized on your device.

Privacy Guides

Practical answers for using AI with your personal documents.

Tax season

Is It Safe to Upload Your W-2 to ChatGPT?

What a W-2 exposes, what happens to files you upload, and how to get AI help without handing over your SSN.

 How-to

How to Redact Your SSN From a PDF Before Using AI

Why a black box doesn’t remove anything, how to redact properly, and how to check it worked.

Frequently Asked Questions

Does my data leave my computer?

Redaction always runs on your device. If you chat with Claude, GPT, or Gemini, only the anonymized text, with placeholders like [PERSON_1] and [SSN_REDACTED], is sent, directly to that provider. If you use a local Ollama model, nothing leaves your computer at all.

Is it safe to use with my W-2 or tax return?

CloakLM detects Social Security numbers, EINs, names, addresses, emails, and phone numbers, and keeps dollar amounts intact so the AI can still do the math. Automated detection is not perfect, so open the Review panel and check the “Raw Output to AI” tab before you send. That tab shows exactly what the AI will receive, and you can redact anything else by selecting it.

Does CloakLM guarantee that all my personal information is removed?

No. Detection is automated and very good, but no tool catches everything, especially in scanned or unusual documents. That is why CloakLM shows you the exact text it will send before anything leaves your computer. Always check it. See the full disclaimer.

Are the messages I type anonymized too?

Yes. Before a message is sent, CloakLM replaces any names or numbers it found in your documents, then runs a final pass for SSNs, emails, phone numbers, and street addresses. It is still best not to type new personal details the app has never seen.

Which AI models does it work with?

Anthropic Claude, OpenAI GPT models, and Google Gemini using your own API key, or any local model you run with Ollama for fully offline use.

Is CloakLM free?

Yes. CloakLM is free and open source under the MIT license. If you use a cloud model you pay that provider for API usage at their normal rates; local Ollama models cost nothing.

Does it work offline?

Yes. Redaction is always local, and with an Ollama model the chat is fully offline too.

Which computers does it run on?

macOS on Apple Silicon (M1 or newer) and 64-bit Windows. CloakLM currently works with PDF files.

Where are my API keys stored?

In CloakLM's settings file on your own device. Keys are only ever sent to the provider they belong to; there is no CloakLM server.