aparte-privacy
Finds personal data in text on the device: names, addresses, emails, phone numbers, URLs, dates and account numbers. A 196 KB model that runs in the browser, in Node, on Android and iOS, with no API call.
This is the personal-data model of aparte. Secrets (passwords, API keys, tokens) are a separate model, aparte-secrets, which runs side by side with this one.
Files
| file | precision | size | use |
|---|---|---|---|
privacy-v1.1-int8.bin |
int8 | 196 KB | recommended |
privacy-v1.1-fp32.bin |
fp32 | 680 KB | reference, for comparison |
references_int8.jsonl |
- | 200 texts | parity references for the runtimes (synthetic texts, written by generators) |
v1/ |
the previous model (1.0.0) and its references |
manifest.json lists the files with their SHA-256 hashes. scores.json has the numbers below.
Runtimes
- JavaScript (browser, Node, workers):
@aparte/privacyon npm, github.com/apartejs/aparte-privacy-model - Kotlin, Android and JVM:
dev.apartejs:privacy, github.com/apartejs/aparte-privacy-kotlin - Swift, iOS and macOS:
ApartePrivacy, github.com/apartejs/aparte-privacy-swift - Python: a numpy reader, the executable specification of the
.binformat (in the JavaScript repository)
The packages are on npm and on Maven Central (dev.apartejs:privacy); the Swift package is submitted to the Swift Package Index. All runtimes give the same spans as the Python reader on the 200 texts of references_int8.jsonl (same text, same category, score within 2e-4).
Categories
private_person, private_address, private_email, private_phone, private_url, private_date, account_number: the same seven categories as OpenAI's privacy-filter, so that the outputs can be compared.
How good
Strict span F1, with the int8 file, on two sets. Public figures and fictional characters count as names to find.
Test set: 384 real chat messages in English and French from public datasets, into which personal data was inserted by an LLM and then replaced by synthetic values; the names were reviewed a second time with an LLM. Most of them are long requests.
| aparte-privacy v1.1 | v1 | OpenAI privacy-filter* | |
|---|---|---|---|
| all categories (micro) | 0.92 | 0.88 | 0.74 |
| personal names | 0.77 | 0.66 | 0.64 |
| addresses | 0.89 | 0.90 | 0.56 |
| emails | 1.00 | 0.97 | 0.88 |
| phone numbers | 0.97 | 0.96 | 0.91 |
| URLs | 0.95 | 0.93 | 0.66 |
| dates | 0.96 | 0.95 | 0.87 |
| account numbers | 0.98 | 0.92 | 0.76 |
Short messages: 1,067 chat messages of a few words in English and French, independent from training: 781 with personal data (64 hand-written patterns such as « Merci … ! », « rappelle-moi au … stp », « Contact …: … », with values from the validation split of OpenPII, plus real messages that name public figures) and 286 real short messages without personal data.
| aparte-privacy v1.1 | v1 | OpenAI privacy-filter* | |
|---|---|---|---|
| all categories (micro) | 0.94 | 0.73 | 0.73 |
| personal names | 0.85 | 0.35 | 0.61 |
| addresses | 0.96 | 0.71 | 0.19 |
| emails | 1.00 | 0.99 | 0.99 |
| phone numbers | 1.00 | 0.93 | 0.80 |
| URLs | 1.00 | 0.83 | 0.86 |
| dates | 0.98 | 0.60 | 0.95 |
| account numbers | 1.00 | 0.97 | 0.94 |
* OpenAI's model (1.5 B parameters) with our simplified decoding (per-token argmax), not their official decoding: its score is probably a little low. Only the seven shared categories are compared; the v1 card also counted its secret spans as errors, which gave it 0.69 instead of 0.74 on the test set.
Limits
- Names are the weakest category. 0.77 F1 on the test set and 0.85 on short messages. The hardest: a name right next to a secret (« I'm …, my openai key is … »), names that are also common words (Pierre, Rose, Olive) and unusual names. Keep a human check on names where it matters.
- A product or service name can be taken for a name, above all next to a key (« ma clé Slack : … ») or at the start of a message. On texts without personal data, v1.1 finds something in 6 of 93 test texts (v1: 5) and 3 of 286 short messages (v1: 1). Use
ignorefor the names you know. - Public figures and fictional characters are masked too. The model cannot know who is famous, so it treats every name the same. Use
ignoreto keep names you want to leave. - English and French only. Other languages are not tested.
- The test set is ours. It is not an independent audit, and real text will differ.
- Do not rely on the model alone for legal or compliance decisions.
Quantization
The int8 file scores the same as fp32 (0.916 against 0.919 on the test set, 0.941 for both on short messages). An int4 file (115 KB) was measured too and is not published: it loses 0.02 F1 on the test set (0.893), 0.06 on addresses and 0.06 on phone numbers.
Training
A 169,117-parameter tagger on byte-level units (the architecture of aparte-secrets), trained from scratch on:
- templated chat messages filled with synthetic values (names, addresses, phone numbers from a phone-number library, IBANs with valid check digits, Luhn-valid cards, URLs of many kinds), long ones, one-line ones and single sentences cut from them;
- synthetic personal data from the OpenPII dataset (CC BY 4.0), 60,000 texts;
- 43,000 real chat messages from public datasets. The names written in them (people, public figures, characters) were listed by a local LLM (Gemma 4 26B, checked against a second LLM on 300 texts) and labelled as names; the rest of these messages counts as text without personal data.
v1.1 has the size and the speed of v1: what changed is the data (short messages, names in real messages, decoys). No secret was used for training this model. Decoy values such as hashes, UUIDs, API keys and names of software, brands, events and works are labelled as not personal data.
License
Weights and code: MIT, Copyright (c) 2026 Paul Richez. The training data includes OpenPII 1M by Ai4Privacy / Ai Suisse SA, CC BY 4.0.