Privacy policy
Opaque is a wallet for private USDC payments on the Arc testnet. It handles testnet funds only, which have no monetary value. This page describes what the wallet keeps on your device, what leaves it, and who can see it. The wallet has no accounts, asks for no email or name, and runs no analytics, ads or trackers.
What stays on your device
- Your account keys. The post-quantum (FORS+C) keys that sign for your Opaque account are kept in your browser's IndexedDB, encrypted under a key the browser does not let the page export.
- Your notes. Each deposit makes notes whose secrets are kept in your browser's local storage. A note secret never leaves your device: the proof that spends it is built on your device.
- Your activity. The payments you send (recipient, time, status handle, settlement transaction) are listed in local storage so Activity survives a reload.
- Backups are files you export yourself, encrypted with a passphrase you choose. They go wherever you save them.
Uninstalling the extension or clearing the site's data deletes all of this. There is no copy anywhere else, so unspent notes without a backup are lost for good.
What leaves your device
The wallet talks only to the Opaque service (hosted on Railway at opaque-stack-production.up.railway.app), which the Opaque team operates:
- Configuration. The wallet downloads the list of relays and the public keys it needs.
- Relayed requests. Payments and every read about your account or notes (balances, account state, whether a note is spent) travel through three relays, encrypted in three layers. The first relay sees your IP address but not the content. The service at the far end sees the content but not your IP address. When a reply is ready, your device collects it from the last relay, which then sees your IP address; it cannot read the reply.
- Your account address and its operations. Deposits and withdrawals are operations your account's key signs. They reach the service through the relays, which forwards them to the network, so the service sees your account address and what the operation does.
- A credential for each recipient. Before your first payment to an address, the wallet asks the service's credential authority for a credential for that address. This request goes directly, not through the relays, so the credential authority sees your IP address and the recipient's address.
- The payment itself. A payment is sealed on your device to the service's payment key. The service opens it to check the recipient's credential and settle the payment, so it sees the recipient and the spend. It never sees a note secret, and the spend does not say which of the eight notes in its ring was yours. In this testnet build, the part that opens payments runs as an ordinary server process, not in a secure enclave, so the Opaque team could read what it opens.
To answer your requests, the service contacts, from its own server: the Arc testnet RPC (rpc.testnet.arc.io), Pimlico's public ERC-4337 bundler (which receives your account's operations), and The Graph (for relay health and pool statistics, which contain no information about you). These providers see the service, not your device.
Railway, the service's host, and Vercel, which serves opaque.credit, may record connection metadata such as IP addresses and request times under their own policies. The service keeps payments and their status in memory only, and forgets them when it restarts. Its logs record the transaction hashes of settled payments, which are public on the blockchain anyway.
What is public on the blockchain
Deposits are public: anyone can see that your account address deposited into a pool, and how much. Settlements are public: anyone can see that a pool paid an amount to a recipient. What Opaque hides is the link between the two, meaning which deposit paid which recipient. Blockchain records cannot be deleted.
Funding wallets
On opaque.credit you can connect a wallet such as MetaMask to top up your account. Requests to that wallet go through the wallet itself, under its own privacy policy. The extension does not use one.
What we do not do
- We do not sell, rent or share information about you with anyone.
- We do not use it for advertising, profiling or creditworthiness, or for anything but running the wallet.
- We do not collect names, emails, contacts, browsing history or the content of the websites you visit. The extension does not read or change any website.
Changes and contact
If this changes, this page will say so, with a new date. Questions or requests: github.com/minrawsjar/Opaque/issues.