How privacy works

What is on chain

For every payment, the chain records:

who sent it and to whom, and when: the sender's and payee's addresses are public;
a commitment to the amount, $C_{n o t e} = v G + r H$ , 32 bytes;
the hash of its two envelopes, so any copy of them can be checked;
the range proof that the amount and the sender's remaining balance are not negative.

The amount $v$ is not on chain in any form that reveals it. Deposits and withdrawals, where USDC enters or leaves the pool, are public.

Who sees what

	Anyone reading the chain	An archive read after Q-Day	The payee	The auditor	The sender
The amount of a payment	No	No	Yes	Yes	Yes
The memo	No	No	Yes	Yes	Yes
Your confidential balance	No	No	Their own	Every note it attested	Their own
Deposits and withdrawals	Yes	Yes	Yes	Yes	Yes
Who paid whom, and when	Yes	Yes	Yes	Yes	Yes

Why it lasts past Q-Day

Two mechanisms keep the amount sealed, and neither depends on a problem a quantum computer solves:

The commitment hides perfectly. For any other amount $v^{'}$ there is a blinding $r^{'}$ with $v^{'} G + r^{'} H = C_{n o t e}$ . No computation, however powerful, can tell which amount is the real one.
The envelopes use ML-KEM-768. Each envelope is sealed with X-Wing, which combines X25519 with ML-KEM-768: the shared secret stays safe while either one holds, and ML-KEM-768 is built to hold against quantum computers. The amount inside is encrypted with AES-256-GCM under a key derived from that secret.

Token-2022's confidential transfers, by contrast, put a decryption handle on chain next to each amount, and one auditor key opens every amount in a mint. A quantum computer that recovers keys from public keys reads those archives. Hindsight puts no decryption handle on chain.

Nobody is credited with what they can't open

Envelopes are not proven correct on chain. Instead, a payee's app accepts a note only after opening it and checking that the opening reproduces the commitment, and in a pool that requires it, the auditor has checked its own envelope first. A wrong envelope can only cost its sender: the payee returns the note, and the sender, who kept the opening, accepts it back.

Your keys

Your X-Wing key and your balance record's key are created in your browser and stay there; back them up from the Account page. Your wallet keeps signing your transactions as it always does. The service never receives an opening, an amount, a memo or a private key: it stores commitments, opaque envelopes and public references.