Updated April 2026Privacy Model

What stays private, what stays public, and why

Kloak is built around private settlement and selective disclosure, but the most important thing is understanding the exact privacy boundary rather than assuming everything is hidden everywhere.

What Kloak promises

Here’s what you can expect when using Kloak.

Settlement is private by default.

Payer identity stays hidden by default.

Wallet-held receipts are the source of truth for later proof generation.

Proofs reveal only the statement the proof owner chooses to share.

Public request pages and some request metadata can still be visible by design.

What is public by design

Not every part of the product is intended to be hidden.

Shareable request pages

Payment-link request pages can be shared openly, so request title, amount, and merchant-facing request terms may be visible.

Proof events

A disclosure transaction happening on-chain can still be visible as an event, even when the hidden payment facts are not revealed.

What stays private

These are the parts Kloak is designed to keep out of normal public view.

Payer identity

Merchant-facing analytics and link detail views do not expose payer identity by default.

Receipt facts

Hidden payment facts used for disclosure stay tied to the wallet-held receipt rather than being treated as general backend data.

Stored proof payloads

Proof payloads are minimized by proof type and encrypted at rest.

Secrets

Sensitive stored material such as webhook secrets is encrypted at rest.

Why receipts matter

The receipt is the bridge between private settlement and later compliance proof.

A valid receipt lets the proof owner later generate a proof without turning the backend into the source of truth for hidden facts.

This is why payer-side and receiver-side proof flows moved toward a wallet-first model.

It is also why receipt-to-payment reconciliation matters when debugging sync issues or recovering older rows.