> For AI agents: the documentation index is at https://docs.umbraprivacy.com/llms.txt, and every page is available as Markdown at its URL with .md appended.

# What is private and what is visible (/docs/privacy/visibility)

Inside the pool, who paid whom, how much and in which token are private. At its edges some of it is public: a deposit shows the depositing wallet, the token and the amount, and a withdrawal shows the destination, the token and the amount, though not who withdrew. This page puts every operation side by side, first as a chain observer reads it, then for every party.

## What the chain shows

**Register: What a chain observer can read**

| Field               | On chain                                  |
| ------------------- | ----------------------------------------- |
| Main wallet         | Your wallet (fee payer)                   |
| Platform wallet     | Your derived wallet (signer)              |
| Identity commitment | A field element. Now tied to both wallets |
| Encryption key hash | Keccak-256 of your ML-KEM public key      |
| Your keys           | Private                                   |

**Deposit: What a chain observer can read**

| Field                   | On chain             |
| ----------------------- | -------------------- |
| Depositor               | Your platform wallet |
| Token and amount in     | Exact                |
| Who receives the notes  | Private              |
| How the amount is split | Private              |
| Zone                    | Private              |

**Private transfer: What a chain observer can read**

| Field            | On chain                  |
| ---------------- | ------------------------- |
| Submitted by     | A relayer                 |
| Relayer tip      | Amount and token, if paid |
| Sender           | Private                   |
| Recipient        | Private                   |
| Amount and token | Private                   |
| Zone             | Private                   |

**Withdraw: What a chain observer can read**

| Field                | On chain              |
| -------------------- | --------------------- |
| Destination          | The receiving address |
| Token and amount out | Exact                 |
| Who withdrew         | Private               |
| Which notes paid     | Private               |
| Change left behind   | Private               |

**Escape hatch: What a chain observer can read**

| Field                      | On chain                           |
| -------------------------- | ---------------------------------- |
| Destination, token, amount | Exact                              |
| The note's fields          | Twelve fields, including its owner |
| Platform wallet            | For identity-owned notes           |
| Who funded the note        | Private                            |

Every value transaction also publishes three nullifiers, three note commitments and three fee commitments. None of them can be tied to a note or an owner without keys the observer does not have. See [nullifiers](https://docs.umbraprivacy.com/docs/state/nullifiers) and [note commitments](https://docs.umbraprivacy.com/docs/state/commitments).

## What each party can learn

Two things carry the most weight:

- **The indexer.** A spend asks the indexer's context service for Merkle paths and nullifier gaps, and the request names your identity commitment and the notes you are spending. Whoever runs that service can link a spend to you. See [how privacy is lost](https://docs.umbraprivacy.com/docs/privacy/leaks).
- **The edges.** A deposit is public and attributable, because registration links your identity commitment to the depositing wallet. A withdrawal publishes its destination, token and amount but not who made it, unless you submit it yourself, withdraw to an address already tied to you, or use the escape hatch. What the protocol keeps private is the path between them.

## Related

- [How privacy is lost](https://docs.umbraprivacy.com/docs/privacy/leaks): Every known way privacy narrows.
- [The anonymity set](https://docs.umbraprivacy.com/docs/privacy/anonymity-set): The set of notes yours cannot be told apart from.
- [Disclosure](https://docs.umbraprivacy.com/docs/disclosure): Who can read which parts of a transaction.
- [Trust assumptions](https://docs.umbraprivacy.com/docs/security/assumptions#who-holds-which-power): The same parties, by what they can do.


Last updated 12 October 2026