Zip SOL into a shared pool, then pay anyone from it. The link back to your wallet stays shut.
A wallet address is enough to read who you paid, how much and when. Zip closes the one line that matters: the one back to you.
4 of these lead back to you. Anyone with your address can read each one, and your balance with them.
Send SOL from your wallet into the pool. It becomes a private note that only your keys can open. This is the one step anyone sees you take.
When you pay, your device proves you own one of the notes in the pool without saying which. Your keys never leave the page.
A relayer submits the proof and pays the network fee. The recipient is fixed by the proof, so it can't be redirected.
The pool pays the recipient. On chain it reads “pool paid an address”. Your wallet isn't in the transaction.
Zip closes the first. The Send screen checks the other two before you send.
Some facts are public by design. The link between you and a payment stays zipped.
| Fact | On chain |
|---|---|
| You deposited into the pool | public |
| How much you deposited | public |
| Send amount and recipient | public |
| Your private balance | 1.000 SOL |
| Which note paid a send | note 0412 |
| That a send came from you | D4mz…q7Lc |
Waiting a while, and sending an amount that differs from your deposit, both make a payment harder to match. The Send screen checks this for you.
It's a shielded pool. Your SOL becomes a note that only your keys can spend, and the program has no instruction that moves a note without your proof. Screening deposits against sanctions lists is planned before any mainnet release.
There's no admin withdrawal: every payout needs a proof only your keys can make, and the proof fixes who gets paid, so the relayer can't redirect it. For now, one key held by the team can still upgrade the program. Until that changes, you're trusting that key.
Any wallet can submit a spend, because the proof already fixes the recipient and the fee. The app only uses Zip's relayer today. Submitting from your own wallet works but links you, so use a fresh one with a little SOL for fees.
Shielding is free. Every private send pays a 1% Zip fee, taken on chain, plus a flat 0.002 SOL to the relayer for network costs. The Send screen shows both, and the recipient always gets exactly the amount you type. The program caps the fee at 5% and refuses a send if the rate changes after you saw it.
Yes. Your private keys come from one signature by your wallet, and an encrypted copy of every note is stored on chain. Connect the same wallet anywhere and your balance comes back.
As private as the pool is busy. Early on the pool is small, so sends are easier to match. The Send screen tells you when a send would be easy to match before you send it.