Privacy
The hosted account
There is a custodial account in this product. It processes card swipes, it holds its own viewing key on a server, and this page exists so you find that out here rather than afterwards.
Sealed is otherwise non-custodial: your wallet derives your viewing key on your device, and the app code never receives it. The card is the exception, and it is a real one rather than a technicality.
What it is
A card authorization has to be decided in the time a terminal waits, and it has to be settled by a party that can sign. That party is a hosted Starknet account with its own shielded balance and its own server-held viewing key.
- It can decrypt its own notes, because it has to spend them.
- It can read every swipe it settles: merchant, amount, time.
- It cannot decrypt your self-custody wallet's notes. Different key, different account. Value you hold yourself is not readable by it.
What that means for you
| If you... | Then the operator... |
|---|---|
| Hold value in your own wallet | Cannot read your balance or history. Your key never leaves your device. |
| Send a private transfer wallet to wallet | Cannot read it. That path does not touch the hosted account. |
| Spend with the card | Sees that swipe in full - merchant, amount, timing - because its own account settled it. |
| Fund the hosted account | Custodies that value while it is there. It is not yours in the way your own notes are. |
Why it is not hidden behind “non-custodial”
“Non-custodial” is true of most of this product and false of one part of it. A blanket claim would be the more marketable sentence and the less accurate one, and a privacy tool that overstates what it hides is worse than none at all, because its users act on the difference.
For the same reason, the two phrases a product like this most wants to use - the end-to-end claim and the “nobody but you” claim - are both on the refused list. Each is false the moment a swipe happens, and a test fails if either reaches shipped copy.
What limits it
- Policy lives in the
CardProgramcontract, not in the server: per-swipe cap, daily cap, blocked categories. The operator cannot exceed a cap by editing application code. - Replay protection is a map in the contract. A repeated authorization id returns confirmed and does not settle twice, held by a test.
- Authorization requests are HMAC-signed; a tampered signature is rejected before anything reaches a chain.
- Demo routes are gated behind a per-request token, and the recipient comes from server configuration rather than from whoever sent the request.
These constrain what the account can do. None of them constrain what it can see, which is the whole subject of this page.