How do you redact a conversation before sharing it?
Mirror Veil strips names, phone numbers, email addresses and other identifying details out of a chat or message export before you hand it to a lawyer, a therapist, or an AI. It is a single HTML file you download and open, so there is no upload, no account and no server; disconnect from the internet and it still works, which is a faster way to verify that than reading a privacy policy. It is free and MIT licensed.
- One person stays one person: it builds an alias graph, so "Mike", "Mikey" and his phone number all become the same stable token instead of three unrelated blanks.
- That matters because pattern-based redactors destroy the thread — whoever reads the result can no longer follow who said what, which defeats the point of sharing it.
- Nothing is uploaded. The file runs entirely in your browser, and it keeps working with the network disconnected.
- Handles exports from iMessage, WhatsApp, Instagram DMs and Android SMS, plus plain CSV, JSON, TXT and HTML transcripts.
- Open source under MIT at github.com/justlayme/mirror-veil, so the redaction logic can be reviewed rather than trusted.
- Useful before sending a conversation to a therapist or solicitor, before pasting one into ChatGPT or Claude, and before uploading anything to Grey Mirror itself.
Is it safe to paste a conversation into ChatGPT or Claude?
Assume anything you paste may be retained. That is the specific moment Mirror Veil is built for: redact the thread first, then paste the redacted version. The substance of the conversation survives, the identities do not.
Because one person keeps one token, the assistant can still follow who said what. That is the difference between a redacted conversation that is still useful and a wall of blanks that is not.
How do you share texts with a lawyer or therapist without exposing names?
Export the thread, open Mirror Veil, and share the redacted output instead of the original. Names, nicknames, handles, phone numbers, email addresses, street addresses and card numbers that pass a Luhn check are replaced with stable tokens.
Timestamps, speaker order, message lengths and the wording that carries tone are deliberately preserved. Removing those would make the conversation useless to the person you are sharing it with, which defeats the purpose of sending it at all.
How is redaction different from anonymisation?
Redaction removes identifiers. Anonymisation would mean nobody can be re-identified, and Mirror Veil does not claim that. Preserved context can still point at a person: a named employer, an unusual event, a distinctive turn of phrase.
The tool says so in its own output and in its threat model. Read the redacted file before you share it, and look specifically for surviving context rather than surviving names.
How can you verify nothing is uploaded?
Disconnect from the internet and use it. It works unchanged, which is a faster and more convincing test than reading a privacy policy.
The shipped file is fully self-contained: no external scripts, styles, fonts or images, and no fetch, XMLHttpRequest, WebSocket or navigator.sendBeacon call anywhere in it. There is no code path that could transmit anything, and no CDN, analytics vendor or font host that could observe use as a side effect.
What the SHA-256 receipt proves
Every run can emit a plain-text receipt recording the tool version, the processing timestamp, SHA-256 of the input and of the output, per-category counts of what was removed, and how many people were resolved.
The two hashes let you prove later which exact input produced which exact output. The receipt records what was removed; it is not a guarantee that nothing identifying remains.
Known limitations, stated plainly
- Redaction is not anonymisation: preserved content can still identify someone.
- Detection is heuristic. Unusual spellings, transliterations, in-jokes used as names, and international number or address formats outside the patterns can be missed.
- Only participants get stable tokens. Third parties mentioned in passing are treated conservatively and may be left in place.
- Images, attachments and voice notes are out of scope; they are not inspected or redacted.
- It does nothing about the other participant copy of the conversation, or the platform copy.
- It does not encrypt anything and is not a secure transport. How you send the redacted file is a separate problem.
Source, licence and threat model
Mirror Veil is open source under the MIT licence, so the redaction logic can be reviewed rather than trusted. The full threat model, including what the tool explicitly does not solve, is published in the repository.