Privacy

Private balance (beta)#

The private balance uses Helius Privacy (Solana Privacy Rings). It is on by default for new wallets: idle XMR above a 0.005 XMR public reserve (from 0.01 XMR) moves into the private balance. Before a buy, withdrawal or fee top-up, only the amount needed moves out — each such step costs one zero-knowledge proof. A deposit that goes straight into a buy is never moved in and out.

Stealth mode (beta)#

Stealth mode makes your trades harder to link to each other and to your main wallet — harder, not impossible. It is off by default — turn it on under Wallet → Stealth mode. Each new position then opens from a fresh sub-wallet derived from your account (m/44'/501'/N'/0', the same scheme Phantom uses for extra accounts), so your seed or passkey restores them on any device (Restore stealth wallets).

• From Monero (recommended): you pay XMR from your Monero wallet, an exchange sends SOL straight to the new sub-wallet, which converts it and buys. No Solana transfer connects the sub-wallet to your main wallet; the exchange sees both sides, and timing can still link them.
• From the private balance: the private pool pays the sub-wallet; the sub-wallet pays the fee and signs, and your account authorizes inside the zero-knowledge proof — your main wallet is not part of the transaction. The sub-wallet needs a little SOL for that fee, so its first funding should come from Monero.
• After you sell, the proceeds go back into your private balance and the empty token accounts are closed (rent back).
• Portfolio shows stealth positions together with everything else; each one keeps its own history.

Privacy score#

Wallet → Privacy score rates from 0 to 100 how easy your activity is to link. It is computed in your browser from this device's history and settings — nothing is sent to a server — so a new device starts without history. Each item shows what was found, how to improve it, and a button that fixes it where a setting can.

Items for features this deployment or wallet doesn't support are left out of the total. The score is a guide, not a guarantee.

Split withdrawals#

Withdraw → Split (2–5 parts) turns one withdrawal into several bridge withdrawals. Amounts are random but round (multiples of 0.01 XMR, at least 0.1 XMR each), the parts go out at random intervals you choose, and each goes to its own subaddress. A few thousandths of an XMR may stay in your balance so every part stays round.

• Enter one new subaddress per part. With fewer addresses the parts repeat them, and the terminal warns you: anyone can add up parts sent to the same address.
• Each part is a normal bridge withdrawal: simulated first, signature stored before sending, and only one part in flight at a time.
• Parts are sent while the terminal is open and unlocked — your keys never leave the browser. A failed part pauses the plan until you retry or cancel the rest.
• Every part pays the bridge fee, so splitting costs a little more than one withdrawal.

Stealth deposits#

Wallet → Stealth mode → New stealth deposit sends a bridge deposit through a new sub-wallet with its own deposit account and XMR address — so the bridge never sees two deposits from the same Solana address, and nothing on Solana points to your main wallet.

1. 1
   Setup payment

   A small XMR payment to an exchange, which sends SOL straight to the new sub-wallet. Your main wallet never transfers anything to it.
2. 2
   Its own deposit address

   The sub-wallet creates its bridge deposit account and pays the rent itself; you get a fresh XMR address.
3. 3
   Send XMR

   From any Monero wallet, any amount from the bridge minimum.
4. 4
   Into your private balance

   The sub-wallet claims its wXMR and moves it into your private balance. Your main wallet only ever sees the private balance.

Split buys#

With stealth mode on and Private balance funding, the trade panel offers Split into 2–5 parts. Each part opens from its own fresh sub-wallet with a random amount (rounded to 0.001 XMR, at least 0.005 XMR) and a random start delay, so a larger buy doesn't read as one trade. Portfolio shows every part with its progress; the holdings add up in your totals.

Network privacy and no logs#

• Your browser talks only to this site: Solana RPC (/api/rpc), Jupiter, exchanges, market data and token images all go through the server. RPC providers and APIs see the server, not your IP. The page's Content-Security-Policy enforces it.
• No logs: the server keeps no request logs with IPs, user-agents or wallet addresses. Rate limiting uses salted hashes held in memory for a minute; error counters have no user data.
• What the server does handle — addresses and amounts for quotes, swaps and status checks — is passed through and not stored. Opt-in features that need storage (referrals, the leaderboard, votes) keep a keyed hash of the wallet, never an IP.
• The optional direct RPC WebSocket (off unless the operator enables it) would connect your browser to the RPC provider; the privacy score shows it.

Using Piconero over Tor#

Piconero works in Tor Browser at the “Standard” and “Safer” levels: no third-party requests, no WebGL, self-hosted fonts. “Safest” turns off JavaScript, which the wallet needs. WebAssembly is only used by the private balance — if it is blocked, that one feature is unavailable and everything else works. An onion address is coming; operators can run one with the guide in docs/TOR.md.

Who sees what#

Recommendations#

• Use a fresh subaddress for every withdrawal.
• Don't reuse the terminal's Solana address for unrelated activity; create a new wallet if you want a clean slate.
• Keep the private balance on so idle funds aren't sitting in public view.
• Remember that timing and amounts can still be correlated — Solana is a public ledger.