Privacy & trust

Best practices

The cryptography does its part unconditionally. These are the habits that stop you from undoing it.

The four that matter most

Withdraw to a fresh addressA destination that is already tied to your identity re-attaches everything the proof detached. A new wallet nothing is known about gives the strongest result.

Do not mirror amountsDepositing a distinctive amount and withdrawing the same amount is a correlation you published yourself. Split withdrawals, or swap part of the balance first.

Let time passEvery deposit anyone makes in the meantime widens the set your proof could be about. Tightly coupled timing narrows it to almost nothing.

Back up your recovery phraseStore it securely offline. It is the only way to recover a private balance. Nobody, including us, can restore an account without it.

Why these four and not others

Because they map onto the only three things that are ever public about a private spend: the amount, the destination and the time, plus the one failure that loses funds rather than privacy.

Public signal	How an observer uses it	Your countermeasure
Amount	Matches a distinctive withdrawal to a distinctive deposit	Split, merge or swap so the amounts do not correspond
Destination	Links the withdrawal to an already-known identity	Use a fresh address
Timing	Pairs a deposit and a withdrawal that are close together	Wait; do not deposit and withdraw in one sitting
Nothing	Cannot recover a lost recovery phrase	Back it up offline

Prefer flows that publish less

A private transfer to another Veilo user never leaves the pool, so it publishes neither an amount nor a destination. A withdrawal has to publish both. If the person you are paying is on Veilo, the transfer is strictly better, not by a margin of degree, but by publishing nothing where the alternative publishes two of the three signals above.

Protect the device, not just the transaction

Your secrets live on your device, and no protocol property survives their compromise.

Verify official linksAlways reach Veilo through official channels. A convincing clone that receives a signature receives everything.

Never blind-signRead what a dApp is asking you to sign. A signature request on an unfamiliar site is the most common way keys and derived secrets leak.

Keep the device secureScreen lock, biometric unlock and current OS updates. A private balance on an unlocked phone is not private.

Separate concernsUse separate accounts for separate purposes. They have no on-chain relationship, so the separation is real.

What to do after a mistake

If you have already withdrawn to an address linked to you, the link exists and cannot be removed, subsequent activity from that address does not repair it. Treat that address as public going forward and start fresh for anything you want unlinked. See What Veilo does not claim.

A note on realistic expectations

Privacy here is statistical. Following every practice on this page does not produce certainty; it produces a large set of equally plausible explanations for what an observer sees. That is the honest description of what a privacy pool buys you, and it is considerably more than the public chain offers by default.