FinePrint Phantom：揭示服務條款與私隱政策中的隱藏條款

This is a submission for the Hacktoberfest Open-Source AI Challenge Week 4: Ghost in the Machine

What I Built

Nobody reads the Terms of Service. That is not an insult; it is a design feature. Eight thousand words of legalese stand between you and the streaming service, and somewhere around word three thousand — long after your eyes glaze over — the document quietly changes character. It stops describing the product and starts describing what the company may do to you: sell your viewing history, track you across the web, take away your right to sue, renew itself forever, keep your data after you delete your account.

Every agreement has a ghost in it. FinePrint Phantom is the séance.

You give it a Terms of Service or privacy policy — a URL, the pasted text, or the built-in sample — and it reads the whole document, end to end, and returns a haunting report:

• the scariest clauses, quoted verbatim (the Phantom is forbidden from paraphrasing a quote or inventing one),
• a plain-English explanation of what each clause means on your worst day, not your average one,
• a scariness score from 1–10 for each haunting,
• and an overall Haunt Score from 0–100 with a one-line verdict.

The theme asked for a ghost in the machine. Mine was already there, hiding in section 7(b). The Phantom just turns the lights on.

Demo

Live demo: https://fineprint-phantom.vercel.app

Try the built-in sample first — the fictional "Streamly" terms, haunted on purpose. The sample earns a Haunt Score of 100 in demo mode: a perpetual, irrevocable license to everything you upload; your data sold to brokers; binding arbitration with a class-action waiver; deletion that deletes nothing. Every one of those clause types is modeled on language that really appears in real consumer terms — Streamly is fictional, its clauses barely are.

A note on honesty: if the live demo is running without an API key when you visit, it says so. The app has a clearly labeled Demo mode in which a built-in heuristic engine reads your actual document and quotes only real clauses from it. Nothing is silently faked — a tool that exists to expose hidden fine print should not have any of its own.

Code

https://github.com/wahajansari08/fineprint-phantom

How I Built It

FinePrint Phantom is a Next.js app whose analysis is a genuine Mastra workflow — not one giant prompt, but three composed steps with validated hand-offs:

1. Prepare. The document is chunked paragraph-by-paragraph (about 3,500 characters per passage). If a document has too many chunks, they are sampled evenly across the whole text rather than truncated at the front — because the arbitration and termination clauses live at the back, and a tool that only reads the first half of a contract is a tool that misses the point.
2. Extract. A Mastra Agent — the Phantom, whose instructions amount to "read like a careful friend, quote only verbatim, judge by the worst day" — reads each chunk and returns candidate clauses as JSON: quote, category, explanation, scariness. Every response is parsed defensively and validated; malformed entries are discarded, never rendered.
3. Compose. The agent dedupes and ranks the candidates and writes the verdict. The Haunt Score itself is never generated — it is computed by deterministic arithmetic from the individual scariness ratings (the three scariest hauntings dominate; breadth adds a little). The model finds and explains; arithmetic decides. That separation is deliberate: an LLM asked to "give this document a score out of 100" produces a vibe, and a vibe is exactly what fine print counts on.

The model is GPT-OSS 120B, an open-weight model, served through Groq's free tier and reached through Mastra's model router, so swapping providers is a configuration change, not a rewrite. URLs are fetched server-side, stripped to text, and capped at 60,000 characters with a truncation notice shown to the user.

There is deliberately no database. The documents are analyzed in memory and discarded. A tool that reads privacy policies for a living has no business keeping copies of them.

Why Does Open Innovation Matter?

Because this tool only works if it can be trusted, and it can only be trusted if it can be inspected.

A closed API could summarize a contract for you — and you would have to take its word for what it found, what it skipped, and what it quietly sent home. FinePrint Phantom is built the other way: an open-weight model whose behavior anyone can test, an open-source agent framework whose workflow anyone can read, prompts and scoring arithmetic that live in the same public repo as everything else. The Haunt Score formula is twelve lines long and printed in the README. If you think a clause was scored unfairly, you can point to the exact line of code that did it.

Open weights made this buildable at all: a solo developer can run a 120-billion-parameter open-weight model over a full legal document for effectively nothing, which means the tool can be free, account-less, and storage-free — no sign-up wall standing between a person and the contract they are about to accept. The most one-sided documents on the internet are agreed to by people who were never really given a chance to read them. Open AI is how you hand the reading back.

The Spirit of It

The moment it landed for me was the sample run. I had written the Streamly terms to be bad — I knew every clause in them — and the report still gave me a small chill: ten hauntings, laid out in a row, each one quoting my own document back at me in plain sight. You grant a perpetual, irrevocable license. We may sell your personal information. You waive any right to a jury trial. I wrote those sentences as fiction and they still read like a warning, because they are one: versions of them are sitting, unread, inside the agreements most of us accepted this month. The ghost was never in the machine. It was in the contract — the machine just finally read it aloud.

Prize Categories

• Overall
• Best Use of Mastra — the analysis is a registered Mastra agent running a three-step workflow (chunk → extract → compose) over an open-weight model, with structured validation between steps.

The app is deployed on Vercel as its production home.