Main site

The privacy model

What is and is not visible, and where that privacy comes from.

NULL's privacy isn't a feature that was added. It falls out of how the protocol is built. That distinction sounds like marketing, but it changes what you have to trust and what an attacker can realistically do.

Where it comes from

Normal privacy tools start with a system that records who owns what, then work to hide those records. The privacy is only as good as the hiding, and the hiding is ongoing work that can be attacked, analysed, or banned.

NULL never makes the record. There's no per-person balance, so there's nothing to hide. Someone who can see absolutely everything the protocol does still can't work out who held what, because that was never calculated.

The test worth applying to any privacy claim: what does someone who sees everything learn? Here they learn what the reserve did. They don't learn whose it was, because that fact doesn't exist.

What people can and can't see

An observer can see that a reserve exists, and how deep it is that value entered it that value left it, and to whom roughly when each happened They cannot see whose value any of it was what anyone holds which payments belong together any history tied to a person

Not hidden, just not yours. NULL does not try to make activity invisible; settlement is public and always will be. What is missing from the record is the link between activity and a person, and it is missing because it was never written down.

Being specific here matters more than being reassuring. Settlement happens on chain, so reserve activity is public and always will be. What's missing is the link between that activity and a person.

What we're not claiming

We're not claiming to hide that you used NULL. We're not claiming the person you paid doesn't know you paid them, because obviously they do. And we're not claiming to protect you from someone piecing things together using information from outside the protocol entirely.

The claim is narrower and holds up better: the protocol doesn't hold personal financial data, so personal financial data can't be pulled out of it.

This isn't obfuscation

Mixers and tumblers all share a shape. You own something, a trail gets created, and then work is done to break the link. That last step is what draws attention, because breaking a link is an active thing you do after the fact.

NULL doesn't do that work, because there's no link to break. How NULL compares has the full contrast, and the threat model covers what an attacker can still do.