How it works
What stays private
Exactly what an observer can and cannot learn from UMBR activity, and the habits that keep it that way.
- Hidden
- Amounts and links inside the pool
- Visible
- Deposits, withdrawals, timing
- Keys held by
- You, on your device
- Status
- Testnet
What an explorer shows#
Here is what a block explorer prints for each kind of UMBR activity.
| Action | The explorer shows | The explorer does not show |
|---|---|---|
| Shield | Your wallet, the asset, the amount, the pool address, the time | What you do with the funds afterwards |
| Private send | A pool transaction, its time, the gas payer, commitments and nullifiers | Sender, recipient, amount, asset balance |
| Payroll run | One or more pool transactions and their gas payer | Headcount, salaries, recipients |
| Claim a link | A pool transaction | Who made the link, who claimed it, the amount |
| Unshield | The receiving address, the asset, the amount, the time | Which deposit or notes the funds came from |
What stays hidden#
- Your private balance in each asset.
- The amount of every payment made inside the pool.
- Who paid whom inside the pool. A spend does not point at the note it consumed.
- Memos and payroll labels, which are encrypted to the recipient.
- Which deposit a later withdrawal came from, as long as the pool has enough other activity.
What the public still sees#
- The pool boundary. Shield deposits and unshield withdrawals show their amounts and the public addresses involved. That is unavoidable: the funds come from and go to ordinary wallets.
- Timing. Every pool transaction has a block time. A deposit followed minutes later by a withdrawal of the same amount is easy to pair.
- The gas payer. If you submit without the relayer, your public wallet pays gas and appears on every transaction you send to the pool.
- Shape. The number of inputs and outputs in a transaction, and how often an address interacts with the pool.
The anonymity set#
Your withdrawal hides among every note that could have funded it. That group is the anonymity set. It grows with the number of people using the pool and with time. On a young testnet pool with a few users, the set is small, and an observer can often guess correctly by elimination.
Each network and each asset has its own pool state, so USDG on Robinhood Chain testnet and pathUSD on Tempo Moderato do not share an anonymity set. Unusual amounts shrink the set further, because they match fewer deposits.
Cashing out without a trail#
- Wait. Let time pass between shielding and unshielding, and let other activity happen in between.
- Use round amounts. Deposit and withdraw common figures like 100 or 500 instead of 137.42.
- Use a fresh address. Unshield to a wallet that has never touched the wallet you shielded from.
- Use the relayer. Then your public wallet does not pay gas for pool transactions and does not appear next to them.
- Do not split the obvious way. Withdrawing a deposit in two halves to two addresses you later merge links them again.
Private from the public, not from an operator#
No UMBR server holds your keys or can read your notes. Proofs are made on your device, and only you can spend. That does not make you invisible to the services you touch on the way:
- The frontend host serves the app and sees your IP address and which pages you load.
- The relayer sees your IP address, the time and the proof it submits. The proof does not tell it your balance or who you paid.
- The RPC provider sees which blocks and contracts your wallet reads, and from where.
You can reduce this by running your own RPC endpoint, using a network-level privacy tool, turning the relayer off, or calling the SDK from your own machine.
What is new and what is not#
The privacy machinery is not new. Notes, commitments, nullifiers and Groth16 proofs have been used in shielded pools for years. What UMBR adds is product around it: stablecoins on Robinhood Chain and Tempo, private payroll with a provable total, claim links, scoped proofs with audience and expiry, and an SDK and MCP server so agents can hold a private balance with limits. The comparison page places it next to the alternatives.
Security and compliance#
- UMBR runs on testnets. Use test funds only.
- The contracts and circuits have not been externally audited. Do not read anything on this site as a claim that they have.
- The app may screen addresses at its boundary, for example refusing deposits from wallets on public sanctions lists. That happens in the frontend and relayer, not in the pool contract.
- You remain responsible for following the law where you live, including tax reporting. Proofs exist so you can show an accountant or authority what they need without exposing everything else.
What we will not promise#
- That you cannot be identified. Edges, timing and metadata can still link activity.
- That a small pool gives you much cover. It does not, yet.
- That your device is safe. Malware that reads your keys reads everything.
- That a recipient will keep your payment to themselves.
Know the edges