Staying private
Practical habits that keep your noircash activity private, and the limits the protocol cannot remove for you.
The cryptography hides balances, amounts, senders and recipients inside the noircash vault. Public NOIR in a wallet is as visible as any other token. Where NOIR comes in or goes out (purchases, shields, sales, unshields) the chain shows public data, and your privacy then depends on your habits and on how many other people use noircash.
Protect the activation signature
Sign it only on the official domain
The activation message says which domain it is for, and ends with "Sign it only on" that domain. Whoever gets that signature can derive your viewing key and see every note you own, past and future. If a site on any other domain asks you to sign it, refuse. Most wallets warn when a Sign-In with Ethereum message names a domain different from the site asking.
That signature cannot move your funds: every spend needs a separate Spend confirmation from your wallet. So:
- sign a Spend request only right after you started a send, sale or unshield yourself;
- if a Spend prompt appears when you did nothing, reject it.
The app keeps your keys in memory only, and its content security policy lets the page talk only to the chain's RPC, the bundler and the indexer.
Keep your NOIR shielded
Privacy is not automatic. NOIR bought outside the noircash app, or sent to you with an ordinary transfer, arrives as public NOIR: anyone can see how much your address holds and where it came from. Shield it to move it into a note, and buy in the noircash app when you want the NOIR to land in a note straight away. See Shield public NOIR.
Leave through fresh addresses
- Sell to a new address that has never touched your identity. The app warns you if you type your connected address.
- Unshield to a fresh address or a contract, not to your main address.
- Never unshield or sell to an address linked to your identity, such as one you used on an exchange with your name, if you care about privacy. The receiving address and the amount are public.
Vary timing and amounts
An observer's easiest tool is matching what went in with what came out.
| Habit | Why |
|---|---|
| Wait between buying and selling | A sale minutes after a purchase is easy to pair with it |
| Avoid selling the exact amount you bought | Equal amounts stand out, even among many transactions |
| Split large amounts, at different times | One large exit is easier to tie to one large entry |
| Keep part of your balance private | Notes that stay in the tree make everyone's set larger |
Know the limits
The privacy set is small early on
A proof hides which notes you spend among all the notes in the tree. Early on there are few, so amounts and timing narrow the search much more. Privacy improves as more people hold and use NOIR. See Key concepts.
New notes are recognisable, spending them is not
When a note is created by a purchase or a shield, the transaction is public: anyone can see which address it came from, the amount and the new note's shares.
What nobody can see is when, or whether, that note is spent. A spend reveals only a nullifier, which needs your nullifier key to compute and cannot be linked back to the note. See Notes and Public balances.
Your network connection is visible
Your browser talks to an RPC node, the indexer and the ERC-4337 bundler. None of them learns your keys, and the indexer serves the same data to everyone. But each can see your IP address and when you connect, and the timing of a request can hint at the operation that follows. The app currently reads the chain when you activate, after each action and when you refresh, not at random times.
If that matters to you, use a VPN or Tor.
Registration and public actions are public
Anyone can see that your address registered a privacy key, and every purchase, approval, shield and registration you send from your own wallet. They reveal what you bought or shielded, not what you do with it next.
Checklist
- The activation message names the official domain.
- NOIR you bought elsewhere is shielded.
- Each Spend prompt matches an action you just started.
- Sales and unshields go to fresh addresses.
- Amounts and timing differ from your purchases.
- A VPN or Tor if your IP address matters.
See also the trust model.