Privacy Policy

Privacy capabilities — what the system actually does

The policy below describes what we collect. This section describes what we have built so that we cannot collect it. Privacy here is selectable per transaction and never mandatory: ask for none of it and you pay nothing for it.

Live today

• Stealth addresses (ERC-5564) — payments to a one-time address only the recipient can spend from. Derivation happens on your device: we never ask for, and never accept, your viewing key.
• Denomination laddering — payouts split into uniform amounts so the value does not fingerprint you. Uniform, not random: random amounts are unique fingerprints, and pieces that sum to the original are linkable by addition.
• Deferred settlement — release on a shared grid tick rather than immediately, breaking the timing link between a request and its settlement.
• Cover traffic — treasury movements are shaped like user payouts, so a payout is not identifiable just by being the only transfer in a window.
• Blind-signed access codes (RFC 9474) — prove you are entitled to something without revealing who you are.
• No raw IP addresses stored, anywhere. Identifiers are hashed under a secret, rotating salt; after a rotation, records either side of it cannot be linked back together even by us.
• Cryptographic erasure — aged records are encrypted under keys that are destroyed on a schedule, so any copy that survives — including in a backup — is unreadable ciphertext.
• Privacy Pool (zero-knowledge withdrawals) — deposit a fixed-size note, then withdraw to a fresh address by proving membership of an association set without revealing which deposit is yours. Association sets prove dissociation from known-bad deposits — never innocence, which would require the identity this exists to protect. Live in beta on Base (0x7940E96d65Db811e61B3EE2F289fE92b3833D309), capped, and not yet independently audited.
• Proof of liabilities — verify we are solvent without anyone's balance being exposed.
• Post-quantum transport — every request rides a hybrid ML-KEM-768 + X25519 key exchange, and conformance attestations are signed with both ed25519 and SLH-DSA (hash-based). Traffic recorded today stays confidential against a future quantum computer.
• Machine-checkable conformance — the properties here are enforced by a fail-closed conformance kernel that re-checks them on every run; an unverifiable property is treated as a failure, never a pass. Verify it live: /svc/api/privacy/conformance.

Oblivious HTTP — live

The relay went live on 8 August 2026 at relay.nightferry.net, hosted in Iceland by a different provider from the gateway, which runs in Virginia. The relay sees your network address and cannot read your request; the gateway reads your request and never learns your address. Linking the two requires compelling two companies under two legal systems.

Requests are additionally held briefly, shuffled, and released in batches, and both requests and responses are padded to fixed sizes — so neither timing nor length reveals which endpoint you called or whether you were answered.

The honest limit: while a single party operates both halves, the protection is against outside observers, network intermediaries and either host individually — not against that operator. Moving the relay to a genuinely independent operator is the remaining step, and we will say so here when it happens.

Guarantees

• No mixer. We do not pool other people's funds to break transfer graphs.
• No identity checks to unlock privacy. Gating privacy behind KYC would defeat it.
• We will not claim protection we cannot deliver. Where a guarantee is incomplete, it is written down as incomplete — which is why the middle section above exists.

Agents: the machine-readable version is in /llms.txt under ## Privacy.

What changed, and how to check it yourself

Privacy claims you cannot verify are marketing. Everything below is checkable without asking us, and the failures we found in our own system are listed alongside the fixes.

Deferred withdrawals — POST /api/pool/withdraw with "hold": {}

Timing is the strongest deanonymiser in a small pool: deposit at 14:02, withdraw at 14:09, and no cryptography saves you. A held withdrawal waits for an exponentially distributed delay and for the anonymity set to reach the floor you named. It is opt-in per request — omit hold and behaviour is exactly as before. Poll GET /api/pool/hold?ticket=; the ticket carries no information about your note.

The subtle part: we do not release the moment your floor is met. The set grows when somebody deposits, and that deposit is a public timestamped event — firing on it would weld your exit to that entry, which is a tighter link than not queueing at all. A second, independent delay is drawn at that moment.

Merkle paths: use /api/pool/tree

Asking for a path with ?commitment= tells us which deposit is yours. That form is no longer served by default; fetch the whole tree and compute your path locally, which reveals nothing.

Cover traffic is now auditable — GET /api/stealth/coverproof

We publish a Merkle root over real payouts, the real count (kUsers) and the observed count including cover (kObserver), bound in a signed commitment fixed before you ask. You can prove your own payout was in a tick. We never publish which entries were cover — the cover set names the real set by complement.

A defect we shipped, and are telling you about

Our cover announcements derived their viewTag from the ephemeral public key, which is published in the announcement itself. Anyone could recompute that relation and identify every cover entry for free. 21 of 31 announcements in the live feed carried that mark, so the anonymity set was 10, not 31. It is fixed. A second, independent tell then showed up: an announced address that never received value is identifiable by one balanceOf call, no cryptography needed. Measured together, 21 of 31 announcements are identifiable by the viewTag relation and the remaining 10 by never having been funded, with no overlap — so the true anonymity set of the historical feed is zero, not the 10 an earlier version of this page reported. Cover emitted from now on is funded and derived correctly; the historical entries are counted, never deleted. Historical entries are counted rather than deleted: a genuine announcement matches the same relation about 1 in 256, and deleting one would strand a recipient whose money is waiting at that address.

Constant-shape replies and constant-rate traffic

Every reply over the private (OHTTP) channel is padded to one fixed size — a refusal, a quote, a tree fetch and a withdrawal are all the same number of bytes. GET /api/privacy/noop is a stateless, unlogged no-op so a client can speak on a fixed schedule whether or not it has anything to say.

Retention

Counterparty addresses in settled routes age into a keyed tag after 30 days: anyone holding an address can still confirm a match, nobody can enumerate who we paid.

Policy changes are logged — GET /api/privacy/policy

A hash-chained, signed record of every change to what we promise, each entry marked tightened, loosened or neutral. Entries commit to their predecessor, so nothing can be edited, reordered or removed without breaking every entry after it. Verify it yourself; the method is in the response.

Machine-checked privacy conformance — GET /svc/api/privacy/conformance

This is the SPHYNX standard — every privacy property this page claims is checked by a fail-closed conformance kernel on each run — a machine-checkable definition of what the system must be, not a description we ask you to trust. Each invariant covers a concrete property (no retained state, one uniform response size, post-quantum forward secrecy, no operator trust, a shared anonymity set, indistinguishable cover traffic). An unverifiable invariant counts as a failure, never a pass, and any failure is reported plainly rather than hidden. Don’t trust the list — fetch it and check the count yourself.

Check our cryptography — stealth-review-bundle.json

The same author wrote our stealth implementation, its tests and the harness that audits it, so our own tests cannot tell you whether we read ERC-5564 correctly. The bundle contains 20 deterministic vectors, reproducible from a seed, with the algorithm in prose. Reimplement it and compare. We would rather you found a mistake than trusted us not to have made one.