Privacy

The short version

• No sign-up, no names, no email addresses (unless you write to us), no cookies, no analytics scripts, no browser storage for your account.
• Your sign-in signature and private account keys never reach our servers. Your device computes your balance and builds every proof locally; the API receives finished proofs and requests for public pool data.
• We keep three small databases: an encrypted burner registry, a bridge record per private bridge, and a ledger of fees. None of them contains your wallet address.
• Deposits and withdrawals are public blockchain transactions. Blackpool hides the link between them, not the transactions themselves.

The website

blackpool.cash is a static site served through Cloudflare. It sets no cookies, loads no analytics or advertising scripts and keeps no account data in browser storage: your sign-in signature lives in memory and is gone when you close the tab. Your browser talks directly to public RPC endpoints of each chain (Robinhood Chain, Base, Arbitrum, BNB Chain) to read balances and confirm transactions; those providers see your IP address and the public addresses being queried.

The relayer API

The app and the CLI call api.blackpool.cash for every private operation. Depending on the operation it receives:

• Finished proofs. To relay a send, swap or bridge, the API receives the proof and its public data: nullifiers, new commitments, encrypted notes, recipient, amount and fee. All of it is published on-chain by the transaction anyway. It does not receive your signature or keys; see the security model.
• What you ask it to do. Amounts, assets, chains and recipient addresses for the operation.
• Your wallet address when you prepare a deposit, because the deposit transaction is sent from it.
• Network metadata. Your IP address is used for rate limiting in memory (a one-minute window). Our hosting providers (Cloudflare and Railway) keep standard request logs — time, path, status, IP address — for a limited period under their own policies.

What we store

Burner registry

Swaps and bridges use one-time burner wallets. Each burner's private key is encrypted in your browser before it is sent and stored as ciphertext together with the burner address, chain, token and timestamps. Rows are filed under a pseudonymous identifier derived from your signature, not under your wallet address. This is what lets Recover find a stalled burner from any device.

Bridge records

For each private bridge we keep the solver deposit address, origin chain, assets, amounts, destination recipient, refund address, transaction hashes and status, filed under the same pseudonymous identifier. It powers bridge status and refunds in the app.

Fee ledger

For every relayed transaction that charged a fee: chain, pool, fee amount and transaction hash. It feeds the public analytics. It contains no user identifier.

What is public on-chain

Anyone can see that your wallet deposited a given amount into a pool, that a withdrawal of a given amount left a pool to a given address, and the fee paid. Encrypted notes and commitments are public but unreadable without your keys. Blockchain data cannot be deleted by anyone.

Third parties

• NEAR Intents (1Click) receives the quote request, deposit address and destination recipient for private bridges.
• Public RPC providers of each chain, called by your browser and by the API.
• CoinGecko for ETH and BNB prices, called by the API without any user data.
• Cloudflare (DNS, CDN, email forwarding) and Railway (API hosting).

We do not sell or share data with anyone else.

Your choices

You can use the open-source contracts and circuits without the hosted API. Registry and bridge rows can only be tied to you through your signature-derived identifier; if you want yours deleted, email us and we will walk you through identifying them and remove them. Deleting burner rows makes those burners unrecoverable through Recover.

Changes and contact

We will update this page when what we process changes, and note the date above. Questions: [email protected].