> For AI agents: the documentation index is at https://sdk.nimbusprivacy.xyz/llms.txt, and every page is available as Markdown at its URL with .md appended.

# What's public and what's private (/explainers/visibility)

A normal SPL transfer shows everything: the sender, the recipient, the token and the amount. With
Nimbus, the way in and the way out still look like that. Everything in between is private.

## What each payment shows

These cards show what anyone reading Solana can see, and what stays private.

A zone is a group of notes within the pool. Most apps use the default zone and never set one.

## How privacy narrows

The proofs reveal nothing about the notes they spend. Privacy can still narrow in these ways:

- **Registration ties the wallets together.** Anyone can see that your user's wallet and platform
  wallet belong to one account. So a deposit can be traced to your user.
- **Amounts and timing can match.** A withdrawal of the amount just deposited, soon after, suggests
  the same person. The chain records no link, but the pattern is there.
- **A known destination gives it away.** If the withdrawal address is already tied to your user, so
  is the withdrawal.
- **The relayer's tip is public.** The SDK pays it in the token being moved, so a tip shows which
  token moved.
- **The recipient learns the sender.** A Private Send records the sender's identity in the new
  notes. Bob can read it and follow it to Alice's wallets.
- **Rare tokens and schedules stand out.** A token few people use, or payments at the same hour every
  week, are easier to group.

## What this means for your app

- **Don't suggest an instant round trip.** Value that stays in the pool for a while, with other
  activity in between, is harder to pair.
- **Don't default to withdrawing what was deposited.** Different amounts remove the easiest match.
- **Let users choose where to withdraw.** Withdrawing to the wallet that deposited links the two
  ends. Say so beside the address field.
- **Tell senders that recipients will know them.** A Private Send is private from everyone except
  the person paid.
- **Keep the sign-in on the device.** Whoever has the stored signature has the account. See
  [The private account](https://sdk.nimbusprivacy.xyz/explainers/private-account).

The protocol documentation covers each point in depth:

- [What is private and what is visible](https://docs.nimbusprivacy.xyz/privacy/visibility): Every operation, field by field.
- [How privacy is lost](https://docs.nimbusprivacy.xyz/privacy/leaks): Every known way privacy narrows.
- [The anonymity set](https://docs.nimbusprivacy.xyz/privacy/anonymity-set): The notes your user's cannot be told apart from.
- [Disclosure](https://docs.nimbusprivacy.xyz/disclosure): Who can read which parts of a payment.


Last updated 21 October 2026