Docs/Privacy guide

Gas for fresh wallets. Keep it that way.

Hidden, and not hidden#

• Hidden: the funding link. A fresh address never receives ETH for gas, so no top-up transaction connects it to the wallet that would have paid. Its first operation carries its own EIP-7702 delegation, applied by the bundler's transaction.
• Hidden, from the relay too: which purchase a stamp came from. The relay blind-signs serials it cannot see, under a key and metadata shared by every stamp of a 30-day window. When a stamp comes back, its serial and signature match no purchase it ever handled. The published pins stop a relay from issuing you a key or window of your own.
• Not hidden: what the fresh address receives. Whoever sends assets to it is linked to it, publicly and permanently. Every operation is public on chain: sender, recipient, token, amount and time.
• Not hidden: your IP address, at purchase and at use. The relay sees it when you ask for issuance (stamp_issue) and when you send (stamp_sendUserOperation). It keeps no logs, but you are trusting that.
• Not hidden: timing. Buying a booklet and using a stamp right away pairs the two in time, for the relay (same IP, minutes apart) and for anyone reading the chain (a StampsBought followed by a first StampCancelled).

What to do: wait before using fresh stamps; buy in batches (several stamps at once, used over days and weeks); reach the relay over Tor or a VPN, or run your own relay. Never use stamps for the buyer wallet's own operations.

Threat model#

An observer reads the public ledger, and the relay operator sees what reaches the relay. Stamps remove the funding transaction from the ledger, and the purchase-to-stamp link from the relay's view.

Do and don't#

• Do create a fresh key for each identity, in a browser profile you don't use with your main wallet.
• Do export the key and your stamps (encrypted) before closing the tab, and burn the identity when you are done.
• Do buy stamps well before you need them, and several at a time.
• Don't connect your main wallet in the session that uses the fresh address. Buying stamps with it is fine; do it in another session, at another time.
• Don't send ETH or tokens to the fresh address from your main wallet, and don't send them straight back. Either writes the link stamps exist to avoid.
• Don't use a unique amount. Round, common amounts blend in; 1,337.42 doesn't.
• Do use Tor or a VPN, or your own relay, if the relay operator seeing your IP address matters to you.

What leaks where#

Reads keyed to your address#

A balance or nonce read tells whoever answers it that someone at your IP cares about that address. So:

• The app sends every address-keyed read (pow_getAccountState) to the relay, which already sees your sends, and only when you import a key, press Refresh, or after a failed send (one read to resync the nonces). Nothing is polled.
• A fresh key needs no read at all: its state is known locally (freshAccountState), and confirmed ops advance it.
• The chain RPC only receives public, address-free reads: epoch parameters, stats and logs. stamp_getIssuer is address-free too.
• The epoch is polled on a fixed 60-second interval. A send normally builds from the last poll, so no read precedes it. When the SDK must read the relay itself first (it waited for the next epoch and refetches it, its own first fetch without a shared poller, a recipient check, or a resync after a failure), it waits a random time (up to 20 s, less near the end of an epoch) before mining or sending, so the relay can't time your send from that read.

Relay-held delay#

pow_sendUserOperation and stamp_sendUserOperation take a delaySec: the relay holds your op for up to the epoch's remaining window before forwarding it, so its time on chain is not the time you sent it. In the app: Privacy options → Relay-held delay. In the SDK: delaySec.

Exposure states#

Everything Stamp shows is in one of three states, always named in words, never by colour alone: clear values anyone can read, masked values only their owner can reveal, and sealed values that never exist or are never shown.

Revealing is always your act, and always brief: nothing lifts on hover or focus, copying never reveals, and every value reseals when you let go, change screens, switch windows or hide the tab. The mask hides values from people looking at your screen; it does not hide anything on-chain. What is on-chain is public, which is why the funding link is sealed rather than masked: it is never written at all.

Nonce key 0#

Standard ERC-4337 tooling (including viem's default) puts Date.now() in the EntryPoint nonce key, which publishes your clock, to the millisecond, on-chain. The SDK always uses key 0 and the relay rejects any other key.

Fingerprints#

Gas limits come from fixed per-template profiles and fees from the epoch, so every op of one template and one postage in one epoch is identical apart from the shared PVG quote. Everyone delegates to the same Simple7702Account v0.9. A stamp op shows only its nullifier, a hash nobody else can tie to a purchase. The miner starts each chunk at a random nonce, so solutions reveal nothing about your device.

The browser#

The key is generated in the tab and held in memory. Encrypted persistence is optional: AES-GCM under a key derived from your passphrase (PBKDF2-SHA256, 600,000 iterations), stored in IndexedDB without the address in the clear. The export of your stamps uses the same scheme. Burn identity erases the key, the saved copy and the session's activity.