Privacy model

What stays public, and what does not.

Velpo uses stealth addresses: each payment goes to a fresh address only your keys control. That removes one link (your main wallet) and nothing else. This page lists every field, what still links, and whom you trust.

Payer's address
Plain PublicVelpo Public
The payer signs the transaction. Stealth addresses protect the receiver, not the sender.
Amount and token
Plain PublicVelpo Public
The transfer and the announcement both carry them. Nothing here hides amounts.
Time of payment
Plain PublicVelpo Public
Every transaction has a block and a timestamp.
Receiver's main wallet
Plain PublicVelpo Not on chain
The money goes to a one-time address derived from the meta-address. Your main wallet is not in the payment.
That two payments go to one person
Plain PublicVelpo Depends on you
Each payment has its own address. They stay apart until you withdraw them to the same place, fund them from one wallet, or move them together.
The one-time address
Plain PublicVelpo Public
It is a normal address on chain, with its balance and history.
The announcement (ephemeral key, view tag, metadata)
Plain Not on chainVelpo Public
Posted so the receiver can find the payment. On its own it does not point to anyone.
Your meta-address
Plain Not on chainVelpo Public
Public by design: payers need it. If you register it, the link wallet ↔ meta-address is public too.
Viewing and spending keys
Plain Not on chainVelpo Only your device
Derived and kept in your browser tab. No server ever receives them.
Which announcements are yours
Plain Not on chainVelpo Only your device
Every visitor downloads the same full list; matching happens on your device.
Where you withdraw to
Plain PublicVelpo Public
The withdrawal is a normal transaction. Send it to your main wallet and the link is made.

Field	Plain transfer	Velpo	Why
Payer's address	Public	Public	The payer signs the transaction. Stealth addresses protect the receiver, not the sender.
Amount and token	Public	Public	The transfer and the announcement both carry them. Nothing here hides amounts.
Time of payment	Public	Public	Every transaction has a block and a timestamp.
Receiver's main wallet	Public	Not on chain	The money goes to a one-time address derived from the meta-address. Your main wallet is not in the payment.
That two payments go to one person	Public	Depends on you	Each payment has its own address. They stay apart until you withdraw them to the same place, fund them from one wallet, or move them together.
The one-time address	Public	Public	It is a normal address on chain, with its balance and history.
The announcement (ephemeral key, view tag, metadata)	Not on chain	Public	Posted so the receiver can find the payment. On its own it does not point to anyone.
Your meta-address	Not on chain	Public	Public by design: payers need it. If you register it, the link wallet ↔ meta-address is public too.
Viewing and spending keys	Not on chain	Only your device	Derived and kept in your browser tab. No server ever receives them.
Which announcements are yours	Not on chain	Only your device	Every visitor downloads the same full list; matching happens on your device.
Where you withdraw to	Public	Public	The withdrawal is a normal transaction. Send it to your main wallet and the link is made.

Velpo does not make a payment impossible to follow. It is not a mixer, holds no pool and has no relayer.

Linkability check

What can still tie a payment to you.

The withdraw screen runs these checks on your actual destination and gas before you sign.

Open the scanner

01
The sender is visible
Whoever pays you is named on chain, and so is the amount. If the payer is known to pay only you, the payment points at you anyway.
02
The amount is visible
A distinctive amount can be matched when it reappears, at the destination or anywhere else.
03
Timing
A payment that arrives and leaves within minutes, or several that leave together, are easy to pair.
04
The withdraw destination
Moving funds to a wallet already tied to you (your main wallet, the wallet that registered the meta-address, an exchange account in your name) links the payment to you.
05
Gas funding
A one-time address that holds only a token cannot pay gas. Funding it with ETH from your wallet is a public link. A tip from the payer avoids this; a signed withdrawal submitted by another wallet shows that wallet.
06
Network metadata
This site's server and the chain's RPC see your IP address when you read the record or broadcast a withdrawal. They never see your keys or which rows you matched.
07
Registration
Registering a meta-address publicly says: this wallet receives stealth payments. It does not say which payments.

Per flow

What each step makes public.

Make keys

Nothing. A signature is not a transaction; the keys stay in the tab.

Register

Your wallet and your meta-address, linked, until you replace it.

Pay

Payer, amount, token, time, the one-time address and its announcement.

Withdraw

The destination, the amount and whoever pays the gas.

Trust

Whom you still trust.

Your browser and this page's code

The code that derives keys and signs withdrawals runs in your tab. A changed page could leak keys; the source is open so it can be checked.

Your wallet

It signs the key message. A wallet that signs non-deterministically gives different keys each time: the app checks this for you.

The standard contracts

The ERC-5564 announcer and ERC-6538 registry already on Robinhood Chain; their runtime code was compared with the canonical deployments.

VelpoSendDesk

New, small, no owner. It forwards funds in the same transaction. It has not had an independent security review.

Contracts on Robinhood Chain

Small on purpose.

ERC-5564 announcer

0x55649E01B5Df198D18D95b5cc5051630cfD45564

Standard contract; runtime identical to the Ethereum mainnet deployment (checked 12 Nov 2026).

ERC-6538 registry

0x6538E6bf4B0eBd30A8Ea093027Ac2422ce5d6538

Standard contract; differs from mainnet only in its chain id and signing domain (checked 12 Nov 2026).

VelpoSendDesk

0xe30092369256dd6D9005989C5013d2E67F64cBdA

Live since block 112,220,128 (12 Nov 2026), source verified on Blockscout. Read the code · Creation transaction

Pays the one-time address and announces it in the same transaction; writes the announced amount itself.
Never keeps a balance: no receive function, the token balance at the target is checked to the unit.
Refuses fee-on-transfer tokens instead of announcing a wrong number.
Optional ETH tip with a token payment, so the receiver can pay gas.
Signed withdrawals for permit tokens (any wallet may submit; that wallet is visible).
No owner, admin, fee, pause or upgrade.

It moves user funds and has not had an independent security review. It needs one before real volumes; start with small amounts.

Planned, not built

Stronger privacy needs more than this.

Planned
Shielded pool
Hiding amounts and senders needs a pool and proofs. Only after a written design and an independent review.
Planned
Relayer
Someone else paying gas for withdrawals, so no funding transfer is needed. Not built; no relayer exists today.
Planned
$VELPO for relayer fees
Planned only once a relayer exists. The token is not needed for anything today, and that utility is unproven.

What stays public, and what does not.

Every field of a payment

What can still tie a payment to you.

The sender is visible

The amount is visible

Timing

The withdraw destination

Gas funding

Network metadata

Registration