Private by default. Public where it counts.
Veil is a non-custodial privacy layer on Robinhood Chain. It keeps the activity between your deposit and your withdrawal off the public record. Deposits and withdrawals stay public. This page covers what is visible, how proving your history works today, the safeguards in the protocol and the rules for using it.
Who can see what
| Data | You | The public (on-chain) | Veil services (proof service, relayer, indexer) |
|---|---|---|---|
| Deposit: wallet, token, amount | Yes | Yes | Yes (it is public) |
| Withdrawal: receiving address, token, amount | Yes | Yes | Yes (it is public) |
| Private Send: amount and who paid whom | Yes | No | The hosted proof service sees the proof inputs |
| Private Buy / Sell: the trade itself (market, amounts, time) | Yes | Yes, it is a normal Uniswap trade | Yes (it is public) |
| Your private balance and note history | Yes | No | The hosted proof service sees the inputs of each proof it makes |
| Your IP address and the data you request | Yes | No | The Veil web server, indexer and RPC provider can see it |
Also public: commitments, nullifiers, Merkle roots, contract calls and the Veil relayer's address. On relayed actions (Private Send, Private Buy / Sell from your private balance) the relayer is the on-chain sender, not your wallet.
Proving your history
Every Veil address has a viewing key. Your notes are encrypted to it, and the app uses it in your browser to find and read your notes. The viewing key can read notes but cannot spend them. Spending needs a separate spending key.
Sharing a viewing key with someone else (selective disclosure) is planned and not live. The app does not show, export or share your viewing key yet, and association sets are not enforced (the testnet registry uses a placeholder root).
Until then, you can show your history the ordinary way: your deposits and withdrawals are public transactions that anyone can check on the Robinhood Chain explorer, and your Private Buy / Sell trades are public Uniswap trades.
What Veil's services keep
- Notes: the app downloads all encrypted notes from the indexer and decrypts yours in your browser, so the indexer does not learn which notes are yours.
- Proof service: it receives the proof inputs it needs to make a proof. Its logs record job status and timing, not the inputs.
- Relayer: it keeps a short job record (a hash of the transaction data, status and transaction hash) so it can retry dropped transactions.
- Web server: it keeps standard access logs, which include IP addresses.
- Faucet (testnet): it records which wallet and network claimed each day, to enforce the daily limit.
Safeguards in the protocol
Public entry and exit
Every deposit and withdrawal is a normal, visible transaction. Value can't enter or leave Veil unseen.
Proof for every spend
Funds leave the pool only with a valid zero-knowledge proof for an unspent note, checked on-chain. Nullifiers stop double spending.
Registered assets only
The pool accepts only assets the admin Safe has registered.
Trade limits
Private trades use slippage limits, a maximum price impact, short quote lifetimes and minimum trade sizes.
Pause without trapping funds
A 2-of-3 Safe controls the pool pause. It stops deposits, private sends and trades. Withdrawals have no pause check, so they stay open.
No upgrade proxy
The pool contracts are not upgradeable. A change to the rules means a new deployment. The Safe can change settings such as assets, pairs, fees and minimum trade sizes.
Association sets are a Safe setting
Every withdrawal checks an association-set root from a registry the Safe controls. Today it is a placeholder root and membership is not enforced.
Admins can't take funds
The Safe cannot spend user notes, change who owns a note or reuse a nullifier.
Issuer controls stay
USDG can be frozen by its issuer, including USDG held inside the Veil contract. The app shows this warning.
Acceptable use
Financial privacy is a normal expectation. Using Veil to break the law is not allowed.
Veil is built for
- Keeping your balances, salary and savings out of public view
- Paying people without exposing your whole history
- Trading without broadcasting your positions
- Protecting yourself from being tracked or targeted
Veil must not be used for
- Moving the proceeds of crime or hiding where they came from
- Evading sanctions, or use by or for any sanctioned person or entity
- Financing terrorism or any other illegal activity
- Fraud, scams or theft
- Any use that is prohibited by the laws that apply to you
By using Veil you confirm that you are not a sanctioned person or acting for one, and that you will meet your own legal and tax obligations.
What the Veil team can and can't do
Can
- Explain how the protocol works and what is public on-chain
- Pause deposits, private sends and trades through the 2-of-3 Safe while an issue is investigated (withdrawals stay open)
- Manage supported assets, pairs and fees through the Safe
- Point to the public deposit, withdrawal and trade transactions, which anyone can read
Can't
- Spend, move or take a user's private notes
- Read your private balance from on-chain data
- Upgrade the pool contracts in place
Questions
Is Veil a mixer?
No. Veil is a private balance you keep and use: you deposit, then send, buy and sell from it. Deposits and withdrawals stay public and every spend is checked on-chain.
Can Veil freeze or seize my funds?
The protocol has no function that lets the team spend or move a user's notes, and no per-user freeze. The pause stops deposits, sends and trades but not withdrawals. The Safe does control the association-set registry that withdrawals check, and assets like USDG can be frozen by their own issuer.
Is it legal to use Veil where I live?
Rules on privacy tools differ by country and change over time. You are responsible for following the laws that apply to you, including tax reporting. If you are unsure, ask a qualified adviser.
Contact
Compliance and law-enforcement enquiries: contact@veil-protocol.com