Umbra Tradedocs
Open Umbra Trade
GuideVenuesPrivacyZcashBuild
Privacy

Who sees what

Privacy boundaries for Zcash-funded venues and public Robinhood-chain swaps.

The Zcash-funded architecture aims to reduce links between trading wallets. It does not guarantee anonymity: timing, amounts, user behavior and external data may reveal links.

Robinhood swaps use a separate public EVM wallet flow. Addresses, balances, approvals and trades are visible, and RPC calls are not OHTTP-shielded. The architecture below describes supported Zcash-funded venues, not Robinhood swaps.

Who sees what

YOUYour browserSeals every requestKEEPSKeys, balances andyour wallet listSENDSSealed calls about you(public prices plain)HOP 1 · CLOUDFLARERelayKnows who, not whatSEESYour IP addressRequest sizes, timesNEVER SEESWhat you askedWhich wallet it's forHOP 2 · VERCELGatewayDublin: what, not whoSEESThe request itselfThe relay's addressNEVER SEESYour IP or cookiesWho sent itALLOWLISTED HOSTUpstreamVenue, NEAR or ZcashSEESOne wallet's requestThe gateway's addressNEVER SEESYour IPYour other walletssealed requestsame sealed bytesHTTPS, from Irelandanswersealed answersealed answerThe app pins the gateway's key (packages/net/src/constants.ts), so the relay cannot swap in its own.YOUYour browserSeals every requestKEEPSKeys, balances andyour wallet listSENDSSealed calls about you(public prices plain)sealed both waysHOP 1 · CLOUDFLARERelayKnows who, not whatSEESYour IP addressRequest sizes, timesNEVER SEESWhat you askedWhich wallet it's forsame sealed bytesHOP 2 · VERCELGatewayDublin: what, not whoSEESThe request itselfThe relay's addressNEVER SEESYour IP or cookiesWho sent itHTTPS, from IrelandALLOWLISTED HOSTUpstreamVenue, NEAR or ZcashSEESOne wallet's requestThe gateway's addressNEVER SEESYour IPYour other walletsThe app pins the gateway's key, so therelay cannot swap in a key of its own.
Requests go left to right and answers come back sealed. To read a request together with your IP, the relay and the gateway would have to share what they each see.
PartySeesNever sees
Your browserEverything: your words, balance and which wallets are yours, encrypted on this device— it sends none of it in the clear
Relay (Cloudflare, mitoshi-web)Your IP, the size and time of each request, and which public markets you look atWhat you ask about your wallets: every such call is sealed
Gateway (Vercel, Dublin)One request's content, such as an address's balance, arriving from the relayYour IP or cookies; nothing in a request says who sent it (timing can still group requests, see What stays public)
Each venueThat one wallet's orders and positions, sent from IrelandYour other wallets, your balance, your IP or country
NEAR IntentsOne swap: a standard ZEC amount in and a fresh wallet out (a funding), or a venue asset in and a fresh shielded address out (a trip home)Who sent it, or your other swaps
The Zcash chainThat shielded transactions happened, and two public steps per wallet: the standard-size payment to NEAR's deposit address, and NEAR's payout into a fresh shielded address when the wallet comes homeAmounts and addresses inside the pool, or that it was you
Umbra Trade's serversOnly what the relay and gateway rows say; there is no database and no accountYour keys, your wallet list, your positions
umbra-trade.vercel.app
The Privacy screen on mitoshi.xyz: Your wallets as the public sees them, then Who sees what with a row for each party, then what Umbra Trade does so nothing links.
The app's own Privacy screen says the same thing, party by party, and lists your live wallets as a copy trader would find them.
The Privacy screen on mitoshi.xyz: Your wallets as the public sees them, then Who sees what with a row for each party, then what Umbra Trade does so nothing links.
The app's own Privacy screen says the same thing, party by party, and lists your live wallets as a copy trader would find them.

What keeps your wallets apart

  • One wallet per position. An order goes to the wallet that already holds that market; otherwise to a ready wallet that has never traded; otherwise you fund a new one. Another position's wallet is never used (positionWallet, packages/engine/src/registry.ts).
  • Its own key on a hardened path of Umbra Trade's own, so no two wallets share a key, a refund address or a request.
  • Standard sizes at random moments. See the rules.
  • Every call sealed. See Oblivious HTTP.

What stays public

What is public on purpose, and the residuals Umbra Trade cannot hide.

Verify it yourself

Network panel, pinned key, headers, testnet transactions.

What stays public

What anyone can see on purpose, and the residual risks written down rather than hidden.

On this page

Who sees whatWhat keeps your wallets apart