Desktop app (power-up)
The desktop app is a power-up, not a fourth way to use CloakAPI. It runs the native tokeniser on your machine, exposes it to any local client through a one-click local proxy, signs receipts with an on-device key, and can drive complete-local models. The three ways to use CloakAPI stay the same (API / SDK / proxy · Chat · browser extension); the desktop app makes them stronger.
What the desktop app adds — and what it does not
Detection coverage is the same everywhere. The desktop app does not detect more
PII than the browser extension or Chat. Every surface runs the same engine and the
same ruleset: the deterministic structured-identifier lane, plus the name lane’s
gazetteer floor and the same optional on-device NER model
(Xenova/bert-base-multilingual-cased-ner-hrl, quantised ONNX), fetched on first use
and cached. The desktop runs it natively; the browser surfaces run the identical model
through WebAssembly. What each lane does and does not catch is documented on
Detection coverage.
What the desktop app genuinely adds:
- A one-click local proxy. A Local proxy toggle in Settings starts an
OpenAI/Anthropic-compatible endpoint on
http://localhost:8799/v1, so any local client, script or IDE gets the drop-in proxy without touching a CLI. See Local proxy. - It works outside the browser. The extension only acts on its four supported sites; the desktop tokeniser is reachable by anything on your machine that can point at a local endpoint.
- On-device receipt signing. Receipts are signed with a P-256 key held on your machine, including zero-egress receipts for local runs, and the gateway countersigns the client attestation.
- Complete-local models. Chat turns can be routed to a local model on your own hardware, with no cloud call at all.
Download
Linux x86_64 — 1.1.0 (available)
| Package | Download | SHA-256 |
|---|---|---|
| AppImage (x86_64) | CloakAPI-1.1.0-x86_64.AppImage | 3fbaf9db1fa66ea371002168cdd799fa6ef082704357395e617986c9fc667992 |
.deb (amd64) | CloakAPI-1.1.0-amd64.deb | 34d97609982756a75790cd67aa5ebc7ff3f50ed77c04b8efababacceb9c4900b |
1.1.0 is unsigned. Verify the SHA-256 of the file you downloaded before running it.
This build uses the Unicode personal-name class — not the withdrawn ASCII-only 1.0.0
engine. No .rpm is published yet.
Windows x64 — 1.0.0 (withdrawn)
Everything below describes what the desktop app does when a build is available. It is kept because the browser extension and the web portal give you the same tokenisation today — see Extension and Chat — and because the local proxy is also available as a standalone binary, which is unaffected by this withdrawal.
Linux x86_64 is available today — see Download above.
macOS is still coming, pending Apple notarisation, and no Linux .rpm is published
yet. Use the Email me when ready button on the downloads page to be notified when
those land.
Good to know
- Paid, key-backed, fail-closed. Local tokenisation requires a CloakAPI account with balance; if it cannot tokenise, it blocks rather than leak.
- Pricing is usage-based, USD only — a flat markup on the underlying model cost (plus the small client-side metering fee). See pricing.
- How it works end-to-end: How privacy works.