Privacy

Spoil them. Stay secret.

The short version: on chain, nobody can link a fan's wallet to the creator they paid. Our server never sees the fan's wallet. A few habits can still give you away, and the app warns you about them.

Public on chain

  • That your wallet deposited into the Privacy Cash pool. Nothing else about what you did next.
  • That a creator's wallet received funds from the Privacy Cash pool, with the amount and the time.

Hidden on chain

Which deposit paid which creator. The pool uses zero-knowledge proofs, made in your browser, so a withdrawal cannot be traced back to the deposit that funded it.

What our server sees

To check that a gift really arrived, your browser opens a payment session with our server. A session holds the creator, the asset, the amount and a timestamp. We also keep a hashed version of your IP address for a short time, only to rate limit requests.

  • We never see your wallet address. Your wallet is used only inside your browser.
  • We delete payment sessions after 24 hours. What stays is the gift record shown on the jar: amount, asset, preset note and alias if you chose one.
  • We keep no IP logs.
  • The message you sign to unlock your private balance stays in memory in your browser. It is never stored or sent to us.

What stays in your browser

These live on your device only. Clearing your browser data removes them, so export what you want to keep.

  • The Privacy Cash cache: your encrypted pool notes, so your balance loads quickly.
  • Your gift history.
  • Your aliases: the random keys you use to take credit on leaderboards without your wallet.
  • Claim links you created, so you can reclaim them if nobody does.

What we store for creators

When a creator signs in with X, we store their X id, handle, display name, avatar, bio and follower count. The follower count is used only to check eligibility at sign-in. The X access token is used once, to read that profile, and is not stored. We also store the jar's receiving wallet and the creator's signature over it, which fan browsers re-check before every gift so nobody, including us, can swap the address.

What breaks your privacy

  • Depositing an amount and then gifting the same amount a few minutes later. Anyone watching can line the two up.
  • Using a unique, recognisable amount that only you would send.
  • Naming yourself, your wallet or your X handle anywhere a creator or the public can see it.
Timing nudge: if you try to send a gift within 60 minutes of a deposit of the same size, the app warns you and offers to wait or change the amount.

Your deposit itself is public: anyone can see that your wallet used a privacy pool. If that alone is a problem for you, deposit from a wallet that is not tied to your name.

The relayer

Withdrawals are submitted by the Privacy Cash relayer, not by us. The relayer is run by Privacy Cash and their privacy policy applies to what it sees. ADMIRER runs no relayer.

Questions

See how it works for the full picture, or the terms for the rules.