Privacy model

Nozy’s privacy has two parts: what the chain hides, and what your infrastructure might still leak.

What Orchard / Ironwood hide (on-chain)

• Sender — Your address and identity are not visible on the chain.
• Receiver — The recipient’s address is hidden.
• Amount — The value of the transaction is hidden.
• Linkability — Observers cannot tie transactions together from ledger data alone.

Zero-knowledge proofs let the network verify validity without learning who sent, who received, or how much. Ironwood (NU6.3) continues that model in a new shielded pool; Nozy migrates Orchard notes via turnstile Plan / Split / Migrate / Broadcast.

What a third-party node can still see (off-chain)

Even with perfect Orchard / Ironwood math, a remote RPC operator is not blind to you as a user. They may log:

That is why the privacy model treats your own Zebrad as part of the product—not an advanced appendix. Hosted RPC is a convenience trade-off, not maximum privacy.

How Nozy keeps ledger privacy strong

• Shielded-only — No transparent addresses; no accidental public sends.
• Orchard + Ironwood — Current and next shielded pools; no legacy transparent-first flows.
• Local cryptography — Decryption, scanning, and proving on your device; keys are not sent to a server for spending.
• Local witnesses — Shielded spend witnesses are derived on the wallet using treestate from RPC—not served as a trusted “witness API” by the node. Your node supplies facts about the chain; your wallet supplies secrets.

How you complete the model (operator checklist)

For the statement “I have true privacy” to hold in practice—not just on paper:

1. Run Zebrad you control (home, VPS, or WSL you operate). Point Nozy at it: Zebra Node Setup.
2. Verify connectivity — nozy test-zebra before sync or send.
3. Sync to tip before spending — stale witnesses block send and increase risk.
4. Prefer local lightwalletd if you use compact sync; avoid remote LWD you do not trust.
5. Network layer — Tor/VPN if hiding your IP from the P2P/RPC path matters (Privacy Networks).
6. Address hygiene — New receive addresses when linkability matters.
7. Backup mnemonic offline — Privacy is meaningless if you lose funds or leak the seed.

What Nozy does not promise

• Invisibility from nation-state adversaries without broader OPSEC.
• Privacy if you paste your seed into a website or use a compromised machine.
• Protection from a malicious recipient who knows you paid them.
• Anonymity if you voluntarily KYC at an exchange and withdraw to a known identity.

The model is: strong ledger privacy by design, plus infrastructure privacy when you run your own node and practice basic hygiene.

Cypherpunk framing

Privacy is selective revelation (Cypherpunk Manifesto). Orchard handles revelation to the network (minimal). You choose revelation to people (recipient). Your node choice controls revelation to operators. Nozy removes the “transparent by mistake” path; you remove the “someone else’s server watches me” path.

For more detail, see Absolute Privacy, Security best practices, and Zebrad connectivity.

Next: Manifesto — principles in brief — or Getting started.