PRIVACY
Privacy Model
Summary
| Data | Client | Matcher | Prover | Public chain |
|---|---|---|---|---|
| Note secrets, spending keys | yes | no | no | no |
| Private order section (decrypted) | yes | no | yes (private boundary) | no |
| Encrypted order payload | yes | opaque only | yes | no |
| Public matching terms (market, side, size, price, expiry) | yes | yes | yes | only as revealed by settlement |
| Epoch secret keys | no | no | yes | no |
| Commitments, nullifiers, roots, token transfers | — | — | — | yes |
A. Client-side privacy
Note secrets never leave the client. Encrypted note-delivery envelopes are downloaded and processed locally in the browser by a browser-safe package; web browser code does not depend on the server-side note-delivery service, and wallet note decryption is not performed by any server.
B. Matcher-visible data
The matcher sees the eligibility proof, its public inputs (including the public matching terms needed to match orders), the order tag and an opaque encrypted payload. It does not receive the decrypted private order section, epoch secret keys or private witnesses, and it has no access to the prover key store.
C. Prover-private data
The prover holds epoch secret keys and opens admitted payloads inside a private boundary that is reachable only from private or loopback network addresses. Opened plaintext stays inside that boundary for private execution.
D. On-chain public data
Everything written to a public blockchain is observable: deposits and withdrawals, commitments, nullifiers, Merkle roots, settlement transactions, gas payers and timing.
E. Metadata and operational limitations
- AZENYX does not provide network-layer anonymity: IP addresses and connection timing are visible to the services and networks a client talks to.
- Timing and amount correlation on the public chain are not eliminated.
- Public matching terms are visible to the matcher by design.
- Privacy guarantees depend on correct client software and on operators running the private prover boundary as specified.