Privacy
Refused claims
The phrases that are false about this system, kept as data rather than as a style guide - because a style guide is advice and a list is testable.
These phrases are false about Sealed as deployed. They live in src/lib/forbidden-claims.ts, each with the reason it is false written beside it, and tests/forbidden-claims.test.ts sweeps every shipped copy module for them. A phrase on this list cannot reach production without turning the suite red.
- 01end-to-end encrypted
- 02e2ee
- 03only you can see
- 04zero-knowledge
- 05view-only key
- 06watch-only
- 07your address never appears
- 08amounts are private
- 09untraceable
- 10fully private
- 11bank account
- 12guaranteed yield
Why some of them read as fragments
They are substrings the test sweeps for, not sentences. only you can see catches “only you can see your balance” and every variation of it without anybody having to enumerate the variations.
Why each one is false here
| Phrase | Why it is false |
|---|---|
end-to-end encrypted | The hosted card account holds its own server-side viewing key and can read every swipe it settles. There is a third party by construction. |
e2ee | Same as end-to-end encrypted, in the abbreviation people actually search for. |
only you can see | False for anything routed through the hosted account, and false for the public deposit and withdrawal legs that need no key at all. |
zero-knowledge | The pool proves things, but every leg that touches an open note has public amounts. The phrase promises more than the protocol delivers. |
view-only key | One key both reads notes and authorises spending them. There is no view-only derivation to hand an accountant, and there will not be one here. |
watch-only | Same as view-only: the derivation does not exist on this pool. |
your address never appears | It appears on the deposit, and on any unshield to a public address. The narrow true claim is that it is not the transaction sender on a private operation. |
amounts are private | False for deposits, withdrawals and the pool fee, all of which are ordinary public transfers. Claim identity privacy; never claim amount privacy for the public legs. |
untraceable | Traceability here is a function of the anonymity set, which on a testnet pool is small. An unusual amount narrows it to one account. |
fully private | No configuration of this product is fully private. The word deletes the entire distinction the documentation exists to draw. |
bank account | Sealed is not a licensed bank, holds no deposits, and offers no protection. "Money account" is the honest noun. |
guaranteed yield | The vault is a Sepolia demonstration holding test money. There is no rate, and nothing here generates one. |
What the list does not buy
Stated precisely, because a page about not overstating things is a bad place to overstate one. The test sweeps the docs, the landing page and the marketing components. It does not sweep every string in the application, and it cannot sweep a screenshot, a tweet or a demo video narration.
Below those modules this is a list a human has to mean. That is why it is published here rather than only enforced in CI.
The narrow claim usually survives
The value of the list is not that it deletes sentences. It is that it forces the true, narrower version of each one:
| What you wanted to say | What is actually true |
|---|---|
| Your address never appears | Your address is not the transaction sender on a private operation. It does appear on the deposit. |
| Amounts are private | Private transfer amounts need a viewing key. Deposit, withdrawal and fee amounts are public. |
| Only you can see your balance | Your wallet notes need your key. The hosted card account reads its own. |
| Untraceable | Unlinkable within the anonymity set, which on this testnet pool is small. |
Every replacement is weaker and every replacement is checkable. That is the trade this product keeps making, and who sees what is the long form of it.