Amounts are commitments, not numbers
What lands on the chain is a Pedersen commitment — a point on an elliptic curve that mathematically binds the sender to a value while revealing nothing about it. Only you and the recipient know what moved.
Your address never appears
Every payment generates a fresh one-time key derived from a shared secret. Two payments to the same address share no visible field — not even the sender can link them afterwards.
Encrypted memos, constant length
Attach a note to a payment; only the recipient can read it. Every payload is padded to the same size, so even the length of what you wrote gives nothing away.
View keys that cannot spend
Hand an accountant, an auditor or a partner a key that reveals every amount and memo you send or receive — and nothing else. It is structurally incapable of moving a coin.
Blocks dissolve transactions
A block does not store a list of transactions. Every payment in it is merged into one flat, sorted set of inputs and outputs, so an observer cannot tell which input paid which output. CoinJoin, automatically, in every block.
No admin, no freeze, no keys
There is no mint authority, no blacklist, no pause switch. Not as a policy — the capability simply does not exist in the protocol, and a fair genesis with zero allocations is enforced in code.
Stem first, then fluff
A payment is handed to one random peer before the network hears it. Combine that with Tor in the wallet if you do not want your ISP to see which seed you dial.
Prove one payment
A view key shows everything. A receipt shows one output: the commitment opens to the amount, and the spend key of your address signs it. An auditor does not need the rest of your wallet.
