What's private, and what isn't
The short version
- Amounts are public, always. Private hides which wallet paid, not how much.
- An @name you pay always knows it's you. Nobody is anonymous to the person they pay.
- Moving several payments you received to one place (your wallet, one exchange address) links them to each other.
- It's only as private as it is busy. Round amounts, and waiting between adding money and sending, help. The privacy meter shows how busy the pool is.
- Looking up an @name asks the network for that name's records, from your connection.
Who can see what
To try it out with an example, see Who sees your payment.
| Onlookers | The person you pay | Only you | |
|---|---|---|---|
| The amount | Yes | Yes | |
| That your wallet paid (Private off) | Yes | Yes | |
| That your wallet paid (Private on) | No, if the pool is busy enough | Yes, by receipt | |
| That two payments went to the same person | No | Yes | |
| Your balance and full history | No | No | Yes, and anyone you give your disclosure key |
Private off: from your wallet
Your wallet pays a new private address that only the recipient can find. Anyone can see your wallet paid that address, and how much. The recipient sees your wallet, and so your @name.
Private on: from your private balance
Money you added earlier (that step is public) is paid out from a shared pool to a new private address. Onlookers can't tell whose deposit paid. The recipient always learns it was you: the payment carries a receipt that proves it.
How private is it?
The pool hides you among everyone who added the same currency. Few people, unusual amounts, and sending soon after adding money all make it easier to guess. The app rounds amounts, warns you when an amount points back to your deposit, and shows about how many deposits could have paid each private send. See Private sends.
Getting paid
Every payment lands at its own private address, so payments to you don't look like payments to one place. To find them and show your balance, the app asks the network about your private addresses mixed in with other people's, and only when a new payment arrives or you refresh. The network operator could still work out which addresses are yours and that they belong together.
Your history
Worked out in your browser from your own keys. No server stores it, and nobody, FortiBlox included, can read it without your disclosure key. If you need to show it (to an accountant, for an audit), you export it yourself.
What FortiBlox can see
Nothing more than anyone else looking at the chain. No payment is encrypted to FortiBlox or to any third party, and FortiBlox keeps no copy of your keys or your history, so there is nothing it could hand over.