Redacta scans contracts, payslips and medical letters for personal data entirely on your device, using Gemini Nano through Firebase AI Logic. You review and approve every redaction. Only then — and only the redacted text — may a cloud model see it for deeper analysis.
0raw bytes sent to the cloud
—of inference served on-device
—sensitive spans found in this session
On-device model
checking…
Gemini Nano, running inside Chrome via the Prompt API. The scan lane is created with InferenceMode.ONLY_ON_DEVICE: if Nano cannot run, the scan refuses — a raw document is never re-routed to the cloud as a fallback.
Model state has not been prepared yet.
EngineGemini Nano (Chrome built-in AI)
Scan modeONLY_ON_DEVICE
Analysis modePREFER_IN_CLOUD, redacted input only
Cost of on-device inference$0, unmetered
Detecting Firebase AI Logic…
1 · Add a document
0 characters
ON-DEVICE LANE · nothing is uploaded
The scan is a single-turn structured request: document in, entity JSON out (schema in data/schema.json). It works with the network cable pulled.
2 · What the scanner found
awaiting scan
Your document will appear here with every sensitive span highlighted in place, exactly where the scanner found it.
CriticalHighMediumLow
3 · Review the redactions
—/100
Sensitivity score
Run a scan to see the on-device summary and the redaction plan. You stay in control: every span can be kept or redacted individually before anything leaves this page.
No entities yet.
4 · The redacted document
The exact text a cloud model is allowed to see will appear here — nothing more, nothing hidden.
Boundary rule: the analysis function accepts this artefact only — analyseRedacted({ redactedText, documentType, entityStats }). Raw text has no path into it.
5 · Deep analysis, safely
CLOUD LANE · redacted input only
Deep reasoning the small on-device model cannot do: what the document commits each side to, clauses that deserve a second look, and every dated obligation. It runs on the redacted text above — verify the payload yourself before sending:
Payload length—
Payload fingerprint (SHA-256)—
Contains raw personal data—
Analysis will appear here after the redacted document is sent.
Privacy ledger
Every inference step, where it ran, and what it carried
Time
Step
Source
Mode
Latency
Payload
Fingerprint
No inference yet. The ledger fills as you work — and every on-device row can be cross-checked in your browser's Network tab: no request leaves the machine.
0 requests · 0 on-device · 0 in-cloudRaw document bytes sent to cloud, all session: 0
How Redacta works
One boundary, enforced in code — not in a policy PDF.
1
Prepare the on-device model
On a user action, Redacta calls initializeDeviceModel() so Chrome downloads or confirms Gemini Nano. Download progress is a first-class state in the interface, never hidden.
2
Scan stays on the device
The document is sent to a model created with ONLY_ON_DEVICE and a JSON schema constraint. It returns structured entities — names, IDs, accounts, addresses, amounts, dates — plus a sensitivity score and a local summary. This step produces zero network traffic.
3
You approve the redaction
Every span is highlighted in place and listed with its type, confidence and sensitivity. Critical and high spans are redacted by default; you can keep or redact any span individually. The redacted document is shown verbatim before anything else happens.
4
Cloud sees redacted text only
The analysis model is constructed from the redacted artefact. Its function signature accepts that artefact and nothing else, so raw personal data has no code path to the cloud. Each response reports its own inferenceSource, which the privacy ledger records next to the payload length and fingerprint.
Scope and honesty notes
Redacta is a redaction assistant, not a legal guarantee: a human reviews every span before a document is shared, and unusual documents can contain data types outside the extraction schema. On-device inference requires Chrome on desktop with Gemini Nano available; on any other browser the scan lane refuses rather than degrading to a cloud upload. This prototype build runs its inference in clearly labelled simulation mode until a Firebase project is configured; the production module (js/hybrid.js) implements the same flow against the real Firebase AI Logic SDK.