Privacy

The beneficiary's identity and wallet

On-chain, a launch names its beneficiary only as an opaque bytes32 id in the FeeVault. For a private claim kit, the id is a hash of a fresh stealth key's address and a random salt. It has no link to the creator's wallet, and nobody can reverse it into a person. Claims are authorised by EIP-712 signatures from that key and submitted by a relayer. The beneficiary never sends a transaction from, or reveals, a wallet of their own.

When a beneficiary withdraws, the destination is either a fresh address they control or a Railgun shield. With Railgun, the receiving 0zk address and everything done with the funds afterwards are hidden by Railgun's zero-knowledge proofs.

Which id you check

The indexer has no per-id lookup endpoint. The claim portal downloads the entire list of beneficiary balances and finds yours locally, in your browser. Everyone who opens the portal makes the same request, so the server cannot tell which id, if any, you care about.

The stealth key

• The key is generated in the creator's browser. It is handed over in the URL fragment (/claim#…), which browsers never send to a server, or as a downloaded claim-kit file.
• When you open a claim link, the app reads the fragment into memory and removes it from the address bar straight away, so it does not stay in history or end up in screenshots.
• The key is never put in a query string, server request, log, error report or localStorage. The one exception is the opt-in, passphrase-encrypted claim-kit store described below.
• Only signed messages are sent to the relayer, never the key.

Social escrows

A social escrow commits to the platform's numeric user id together with at least 128 bits of secret randomness, so nobody can find an escrow by guessing account names. The information needed to open it (the platform and user id) is encrypted separately to each configured attestor's key, so any one of those attestors, or anyone who steals one attestor's hint key, can read which account an escrow is for. What no single attestor can do is move the funds: binding the escrow needs signatures from k of n attestors plus a public timelock, during which any attestor or the guardian can veto.

The creator either enters the account's numeric user id (free) or pays a small x402 fee in USDT for an attestor to look up the handle. That payment is public on chain: it shows that the creator's wallet paid for a handle-based escrow, though not which platform or handle. Creators who mind can pay from another wallet or enter the numeric id.

All trades

Buys and sells happen in public PancakeSwap pools. Your wallet, amounts, prices and timestamps are visible to everyone, as on any DEX.

Fee accruals per id

Anyone can see how much each beneficiary id has earned, its balance per asset and every claim, consolidation and shield from it. The id is opaque, but its activity is public.

Coin metadata

If a coin is called “Fund for @alice” with Alice's picture, the beneficiary is no secret. zk-pad can still hide the wallet that receives the money, but not the cause the creator advertises.

The relayer sees claims

The relayer receives your signed claim, so it sees the id, amount and destination (a fresh address, or the shield transaction) and the network address your request came from, unless you use Tor or a VPN. It cannot change the destination or amount you signed.

Small anonymity sets

BSC has relatively little shielded value in Railgun, and few beneficiaries claim at any given time. A unique amount or an unusual token can be matched to a later unshield.

Timing correlation

Claiming right after a coin pumps, or unshielding exactly what you shielded soon afterwards, makes linking easier. So does acting at the same time as a public social post.

Creators and dev buys

The creator's wallet that sends the launch transaction, and any dev buy, are public. Only the beneficiary is hidden.

Attestors in social binds

To bind a social escrow you log in to k attestors via OAuth. Each one learns your platform account and the new stealth owner address it signs for. They revoke the OAuth token immediately, but they do see the link.

Nothing about you. There are no analytics, tracking pixels, fingerprinting, cookies, advertising IDs or third-party scripts, and the app sets no session identifiers.

• Pages are served with Referrer-Policy: no-referrer, and external links open with noopener noreferrer.
• Requests to the indexer and services are sent without credentials or cookies.
• Token images are not loaded by default. They live on https hosts or IPFS gateways chosen by each creator, and fetching one reveals your IP address, the time and which token you are viewing to that host. Every token shows a generated avatar instead. See Token images to opt in for this tab session.
• Your wallet and its RPC provider see the reads and transactions you make. Pick a provider you trust, or run your own node.

With Load token images off (the default), the app never requests a token image: lists and token pages show a deterministic gradient avatar derived from the token address. Turning it on fetches each image directly from the URL in the token's on-chain metadata (ipfs:// through the public ipfs.io gateway), without a referrer. The choice is kept in this tab's session storage only, so it resets when you close the tab. Previews of an image URL you type yourself in the launch wizard or metadata editor always load.

Indexer

Serves public chain data. Beneficiary data is only ever served as a full download. It is built without per-user request logging or IP retention.

Relayer

Receives signed messages (claims, consolidations, key rotations, pings) and submits them on-chain for a fee taken from the claim. It does not keep per-user logs, but it necessarily sees each request while handling it.

Attestors

Only take part in social escrow binds. They verify your account via OAuth, sign a BindOwner message and can veto suspicious binds during the timelock.

Railgun / PPOI

Shields are screened against a sanctions list for about one hour. Screening looks at the submitting address (the relayer), not the beneficiary.

The app stores only non-secret preferences in your browser:

• selected network and interface choices such as filters;
• for the current tab session only (session storage), whether you turned on “Load token images”;
• only if you opt in, encrypted claim kits. They are encrypted with AES-GCM under a key derived from your passphrase (PBKDF2-SHA256, 600,000 iterations) and never leave your device. Without the passphrase they are unreadable, including to us.

Clearing your browser data removes all of it. Downloaded claim-kit files are your responsibility to keep safe.

1. 1

   Use Tor or a trusted VPN

   This hides your IP from the relayer, the RPC provider and image hosts.
2. 2

   Shield to Railgun, not to a known wallet

   Consolidate into USDT and shield (USDT only). Wait out the ~1-hour PPOI standby, then wait longer.
3. 3

   Break amount and timing links

   Claim round amounts, split withdrawals and never unshield exactly what you shielded right afterwards.
4. 4

   Guard the claim link

   Anyone with it can claim. Rotate the key if it may have leaked. See the FAQ.