Privacy
What does each observer learn, and from where? This page follows the project’s own
privacy review (docs/privacy-review.md, 2026-11-05, with fixes through 2026-11-08). That
review was done by the project’s own agent, standing in for an outside reviewer who does not
exist yet.
There are three places to look: Bitcoin, the share chain (public: anyone may follow it, and every contribution travels on it before it settles), and the network.
Hidden
Section titled “Hidden”- Who paid whom. A record is two commitments and two nullifier keys. Commitments are hashes of random-looking values; nullifier keys are hashes of a secret and a position. Nothing links a nullifier to the note it spends, or a commitment to the address that can open it.
- How much. Amounts are inside the proof and the commitments. The memo word carries a payment’s amount padded with a value only the payee can derive.
- How many notes a payment used. Every contribution is two in, two out, with dummies (count hiding). Orchard shows its action counts; Cheshire does not.
- Which deposit a payment spends. A deposit’s amount and coin are public; what happens to the note afterwards is not.
- Individual fees, on Bitcoin. Only each settlement’s total reaches Bitcoin.
- Your IP address, with Tor on (the default): no node and no Bitcoin peer sees it.
- Which prover earned what across settlements: pay keys are one-time (paying the provers).
Visible
Section titled “Visible”On Bitcoin:
- That contributions happened: one record each, so each settlement’s count is public. (Hiding it would need fixed-size settlements; written down as an option, not taken.)
- Deposits, with amounts, and the coins that funded them.
- Withdrawals, with amounts and destination addresses, in the vault’s fan-out.
- Handshakes: a first payment from someone to someone. Not between whom.
- Timing: which settlement, which block. Settlements happen when people transact, and today they are small.
On the share chain, for each contribution while it waits:
- whether it is a withdrawal, with the amount and destination (Bitcoin hides which record is a withdrawal; the share chain does not);
- its fee (so the wallet pays only ladder values: a fee says which level, not which wallet);
- the anchor root it proved against (the wallet always uses the newest state it has checked, so an old anchor does not single it out);
- the order it arrived in, and the share that first referenced it;
- what each one-time pay key earned in its settlement.
On the network:
- your Tor guard sees that your phone uses Tor, and when and how much it sends, not where;
- someone who can watch both your side and the node’s side can match them by timing;
- with Tor switched off, the node you send to sees your IP address;
- a prover’s node shows its IP address to its peers, and its share timing can link its pay keys.
- The pool’s edges: deposits, withdrawals and timing.
- Zero knowledge, precisely: what the proofs hide, and the assumptions.
The short version
Section titled “The short version”Inside the pool, payments are unlinkable. At the edges (deposits, withdrawals, timing, and whatever you reveal yourself), they are as private as your habits and the pool’s volume allow. Today the volume is tiny.