Privacy
What stays public
What anyone can see on purpose, and the residual risks written down rather than hidden.
Public on purpose
| What | Why it is public |
|---|---|
| Each wallet's own trades on its venue | The venues are public markets; Umbra Trade hides who traded, not what |
| One hop in and one hop out per wallet, through NEAR | The funding pays NEAR's deposit address at a standard size many swaps share. The trip home carries whatever the wallet holds, so its amount is public; it lands at a fresh shielded address, and the leak meter warns if you later withdraw a matching amount publicly |
| NEAR's record of each swap | Confidential mode, where a deposit and its payout can't be matched, covers every funding and every trip home except Polymarket's. That one pays out through Polymarket's bridge with a flexible-input quote, and 1Click has no confidential mode for those |
| Polymarket's builder attribution on each wallet's gasless relayer calls (creating it, approvals, redeeming, moving pUSD into Perps, the trip home) | Polymarket can tell these come from Umbra Trade users, and when, not which one |
| Which public markets an IP looks at | Prices, books and list pictures come through the relay unsealed. Your wallets, orders, balances and the pictures of what you hold go sealed |
What 'confidential' means in the app
Umbra Trade asks for confidential mode on every quote it can; that needs NEAR's partner key on the gateway. If 1Click refuses a confidential quote (HTTP 401), the app uses public quotes for the rest of the session. The funding sheet's route line and the Privacy screen show the mode NEAR granted, read back from the signed quote: "confidential" or "public", in amber when public.
What Umbra Trade cannot hide
Read these before you trust it
- One operator runs the relay and the gateway and serves the app. Keeping the two apart is a promise you can check in the source, not something the code enforces.
- Reading your wallets. While Portfolio or a terminal is open, the gateway and the venues see those balances asked about in the same stretch of time. Each wallet is read on its own random rhythm (every 4–8 s on a terminal, every 20–60 s on Portfolio), through one gateway address shared by everyone, but a watcher of many sessions could still notice two addresses always asked about together.
- Timing analysis. Random starts and rests make it hard, not impossible, for someone with the whole public record.
- The recovery scan asks about one derived address at a time, 3–9 s apart. Someone watching the gateway during a restore could still group them, so it runs only after a restore from words or when you ask for it.
- Moving Orchard to Ironwood. Each part of a migration publishes one standard amount crossing pools at a random time, the same shape as every other ZIP 318 migration; payments never cross.
- Block explorers. Opening one for your wallet from your own browser shows it your IP. Umbra Trade's "What the public sees" reads the same data through the gateway; use Tor or a VPN for explorers.
- Light servers. Compact blocks come from ChainSafe's public servers, which only ever see the gateway, until Umbra Trade runs its own.
- The app must be open. Fundings, keep-ready and swap tracking run in your tab; nothing runs on a server for you.