Start here
What Sealed is
5 transactions have settled against StarkWare's canonical STRK20 privacy pool on Starknet mainnet, and 6 more on Sepolia, across 11 contracts you can open in an explorer. This page defines the product around them.
verify-evidence.mjs: 12 of 12 passed, read at block 15,768,228, 2026-10-02 06:43 UTC. Checked less than an hour ago, live against the RPCs named in the script.
A private money account on Starknet's STRK20 pool, meaning hold, swipe a card, earn and bridge in, plus a row-by-row answer about what that does and does not hide.
Sealed is an account that holds value as shielded notes inside StarkWare's STRK20 privacy pool and spends it without publishing your balance. A card swipe sells shielded STRK, pays the merchant in USDC, and records the settlement, all inside one transaction on chain.
Holding and shielding are live on Starknet mainnet, through the canonical STRK20 pool, with four settled transactions and real STRK spent on the pool fee. Everything built on top of that, the card swipe, the earn vault and the CCTP bridge, runs on Sepolia testnet with test money, because those are this project's own contracts and they are deployed on Sepolia only. That split is stated here first because it qualifies every other sentence in this documentation: check which network a page names before reading a number off it.
The part that is actually different
It is not the privacy claim. Every product in this category claims privacy. It is that this one names the parties who can read your activity before you act, including the one you did not choose.
There is a hosted account in this product. It processes card swipes, and it holds its own server-side viewing key. That account is custodial, inside a product that is otherwise not. It gets its own page rather than a footnote, because a privacy tool that overstates what it hides is worse than none at all: its users act on the difference.
What you can do with it today
Each row is the honest state, not the roadmap. The evidence for every LIVE row is a transaction hash on the evidence page.
Shield STRK or USDC into the STRK20 pool and hold it as notes. Your balance is decryptable by your viewing key, not by the explorer.
A card authorization settles from shielded value in a single Sepolia transaction: sell STRK, pay the merchant in USDC, record the settlement.
A restaurant swipe can open a lending position in the same invoke that pays the bill. total_assets is read live from the deployed vault, never projected.
USDC bridged from Base Sepolia over CCTP V2 lands and shields in one flow, so value arrives already inside the pool.
A viewing-key scoped statement for one authorization. Without the key it omits amounts; with it, the full settlement is readable.
Per-merchant spend identities are deployed and deterministic, and one shadow spend has settled on Sepolia. It is not yet the default path for every swipe.
A Lithic sandbox issuer is wired to a live authorization-decisioning webhook. No production issuer, no real network, no real money.
Four transactions have settled against the live STRK20 pool on mainnet: two shields and two viewing-key registrations, all SUCCEEDED. Holding and shielding are therefore live with real STRK. Every contract in this documentation is still deployed on Sepolia only, so the card, vault and bridge loops are not on mainnet, per surface status.
What this is built on
The STRK20 pool is StarkWare's, not ours: a deployed privacy pool with audited cryptography. Sealed is an account, a card runtime, a lending vault and five helper contracts built on top of it. The distinction matters when you are deciding whom to trust: the cryptography is theirs, the product around it is ours and has not been audited by anyone.
The helpers all follow the same shape, a Cairo contract invoked inside the pool's privacy_invoke, so a withdrawal, a swap, a payment and a re-shield land as one atomic transaction. The swipe walks through a real one, event by event.
Where to go next
- Quickstart · From opening the page to your first shielded balance, step by step.
- Surface status · Every surface, marked live, partial, or not built, with the evidence.
- The account · Notes, viewing keys, and why the wallet has to be Ready.
- The swipe · One transaction that authorizes, converts STRK to USDC, and pays the merchant.
- The vault · A swipe that also opens a lending position, atomically, in the same invoke.
- Funding and exit · CCTP in from Base, shielded on arrival. Unshield out to a public address.
- Who sees what · The five parties that touch a payment, and exactly what each one learns.
- The hosted account · The custodial exception in a non-custodial product. Read before you swipe.
- Refused claims · Twelve sentences this product will not say about itself, and why each one is false.
- Evidence · Every contract and transaction, on chain, checkable without trusting us.