02 · Use
Sending a private request
The app at /app is one page with four stages. Nothing is sent while you type, and nothing is published unless you anchor a receipt with your wallet.
The four stages
- Write. Type or paste up to 4,000 characters. Add names, companies and places to your word list; it stays in this browser.
- Check. The left column shows your original with each detected detail highlighted; the right column shows the text that would leave, with placeholders. Switch any kind of detail off if the answer needs it.
- Ask. The masked text goes to the configured model provider, or to the demo responder in your tab when none is configured. The answer comes back with placeholders; "Fill in originals" restores them on your screen only.
- Seal and anchor. With a wallet connected, seal a receipt, then anchor it (a record() transaction on the ledger). Download the receipt file to prove it later on the verifier.
Who answers
| Responder | What it sees |
|---|---|
| Demo responder (demo/local-responder-v1) | Runs as code in your browser when no provider is configured. It is not a model: it reports what it received, so you can see what a provider would have been sent. Nothing leaves the device. |
| Model provider | When the site operator sets a provider key, the masked text is sent over HTTPS through this site's server to a third-party model provider. The provider can read the masked text while it answers. The server refuses text that still holds a key, a secret or a card number, checks the model's price, limits each network to 6 requests per 10 minutes, and stores nothing. |
What is kept, and where
- In this browser: your word list, which kinds are switched off, saved receipts (masked request, answer, salt, hash) and the activity log.
- In files you download: one receipt per file, in JSON.
- On Robinhood Chain, only if you anchor: the receipt hash, the model tag, your address and the block.
- On this site's server: nothing about your request. Rate-limit counters only.