Does a chat analysis remove names? What masking misses
Masking replaces five kinds of identifier before anything is sent. The Portraitor policy also writes down what it does not remove, which is the rarer half.
Portraitor’s policy says your browser removes names, email addresses, telephone numbers, postal addresses and credentials before anything is transmitted. It also says, in the same section, that this removes who is speaking and does not remove what was discussed.
Most tools that read a conversation say something reassuring about anonymising it. Very few write down the part that anonymising cannot do.
The Portraitor privacy policy does, in two consecutive paragraphs of section 2, and the second paragraph is the one worth reading twice.
Five kinds of identifier, replaced before anything is transmitted
The policy names them: names, email addresses, telephone numbers, postal addresses and credentials. It says your browser removes them and replaces them with anonymous placeholders, and that this takes place entirely on your own device.
The sequencing is the claim. Replacement happens before transmission rather than after arrival, so the unmasked version of the conversation never exists anywhere except where it already was. The policy also says the placeholder list that makes the swap reversible stays on your device and is not sent.
The thing doing the replacing is itself described. Section 6 lists a cached copy of the privacy filtering model among the items kept on your device, so that it is downloaded once rather than on every visit, and the register in section 5 says Cloudflare serves the privacy filter that your browser and the iPhone app download. In other words the filter is fetched to you and run where you are, rather than your conversation being sent to where the filter is.
The same arrangement is described for the iPhone app. The policy’s opening summary says identifiers are removed on your device, in your browser or in the iPhone app, before anything is transmitted, so the route in is not what decides whether masking happens.
The sentence most privacy pages decline to write
Here is the next paragraph, and it is the reason this page exists. The policy says masking removes who is speaking, and that it does not remove what was discussed. It then gives the example itself: if the people in the conversation talked about their health, beliefs, relationships or sexuality, those passages travel to the analysis provider inside the anonymised text, with no name attached.
A company does not have to publish that. It is the sentence a cautious reader would have had to work out alone, and most pages in this category leave them to it.
Subject matter travels, with no name attached to it
So the accurate description is narrow. What goes out is a conversation stripped of the labels that say whose it is, carrying everything the conversation was about. An analysis provider receiving it can read the subject matter in full and cannot say who any of it belongs to.
Whether that is enough is a judgement about your own thread, not a judgement anyone can make for you. A conversation whose sensitivity is in the names is well served by this. A conversation whose sensitivity is in the topic is less so, and the policy is the document that tells you which one you have.
The related questions have their own answers on the same page: whether the provider may use what it receives and what happens to the other people in the conversation.
What happens when the replacement does not finish
The policy commits to a specific behaviour rather than a general intention. If masking does not complete successfully, it says, no data is transmitted and your payment is refunded automatically.
That is a failure mode with a stated outcome attached, which is unusual, and it is checkable in the one way that matters: the refund is automatic rather than available on request. A policy that says masking might fail and then says nothing about what follows is describing a hope.
It also tells you which way the design fails. A system that transmits first and masks on arrival fails open, because a fault has already sent the unmasked text. This one fails closed: the stated consequence of an incomplete mask is that nothing goes at all, and the money comes back without anyone having to notice and ask.
The question worth asking any tool that says it anonymises
Ask what the masking does not cover, and see whether the answer is written down anywhere you can quote. Most pages in this category say the data is anonymised and stop. The difference between that and a published limit is not presentational; it is the difference between a claim you can check and a claim you cannot.
Portraitor’s own version is narrow and it is on the record. It removes the identifiers it names, it does not remove subject matter, and it says so before you pay. The home page and the privacy page are where both halves are published, and choosing yourself as the subject is the other lever you have over what is read in the first place.
Frequently asked questions
Frequently asked questions
What exactly is replaced?
The policy names names, email addresses, telephone numbers, postal addresses and credentials. They are replaced with anonymous placeholders in your browser or in the iPhone app before anything is transmitted.
Does the analysis provider see what we talked about?
Yes. The policy says masking removes who is speaking and does not remove what was discussed, and names health, beliefs, relationships and sexuality as examples of subject matter that travels inside the anonymised text with no name attached.
Where is the list that maps placeholders back to real names?
On your device. The policy says the placeholder list is kept on your device and nowhere else, alongside a small number of other items, and that none of them is transmitted.
What if masking fails halfway through?
The policy says no data is transmitted and the payment is refunded automatically.
Anonymised is not one thing. Ask which half of your conversation it covers, and prefer the service that has already written the answer down.
Masking removes who, not what
Portraitor replaces names, email addresses, telephone numbers, postal addresses and credentials in your browser, and publishes the limit of that in the same section.
See how Portraitor works →