Docs/Privacy guide

No funding link. Keep it that way.

Threat model#

An observer reads the public ledger. The one thing Unlinked removes from it is the funding transaction: a fresh address never needs ETH, so nothing ever connects it to the wallet that would have paid for its gas.

Do and don't#

• Do create a fresh key for each identity, in a browser profile you don't use with your main wallet.
• Do export the key (or save it encrypted) before closing the tab, and burn the identity when you are done.
• Don't connect your main wallet in the same session. The app never asks you to.
• Don't send ETH or tokens to the fresh address from your main wallet, and don't send them straight back. Either recreates the link Unlinked removes.
• Don't use a unique amount. Round, common amounts blend in; 1,337.42 doesn't.
• Do use Tor, or your own relay, if the relay operator seeing your IP address matters to you.

What leaks where#

Reads keyed to your address#

A balance or nonce read tells whoever answers it that someone at your IP cares about that address. So:

• The app sends every address-keyed read (pow_getAccountState) to the relay, which already sees your sends, and only when you import a key, press Refresh, or after a failed send (one read to resync the nonces). Nothing is polled.
• A fresh key needs no read at all: its state is known locally (freshAccountState), and confirmed ops advance it.
• The chain RPC only receives public, address-free reads: epoch parameters, stats and logs.
• The epoch is polled on a fixed 60-second interval. A send normally mines from the last poll, so no read precedes mining. When the SDK must read the relay itself first (it waited for the next epoch and refetches it, its own first fetch without a shared poller, or a resync after a failure), it waits a random time (up to 20 s, less near the end of an epoch) before mining, so the relay can't time your mining from that read.

Relay-held delay#

pow_sendUserOperation asks the relay to hold your op for up to the epoch's remaining window before forwarding it, so its time on-chain is not the time you mined it. In the app: Privacy options → Relay-held delay. In the SDK: delaySec.

Exposure states#

Everything Unlinked shows is in one of three states, always named in words, never by colour alone: clear values anyone can read, masked values only their owner can reveal, and sealed values that never exist or are never shown.

Revealing is always your act, and always brief: nothing lifts on hover or focus, copying never reveals, and every value reseals when you let go, change screens, switch windows or hide the tab. The mask hides values from people looking at your screen; it does not hide anything on-chain. What is on-chain is public, which is why the funding link is sealed rather than masked: it is never written at all.

Nonce key 0#

Standard ERC-4337 tooling (including viem's default) puts Date.now() in the EntryPoint nonce key, which publishes your clock, to the millisecond, on-chain. The SDK always uses key 0 and the relay rejects any other key.

Fingerprints#

Gas limits come from fixed per-template profiles and fees from the epoch, so every op of one template in one epoch is identical apart from the shared PVG quote. Everyone delegates to the same Simple7702Account v0.9. The miner starts each chunk at a random nonce, so solutions reveal nothing about your device.

The browser#

The key is generated in the tab and held in memory. Encrypted persistence is optional: AES-GCM under a key derived from your passphrase (PBKDF2-SHA256, 600,000 iterations), stored in IndexedDB without the address in the clear. Burn identity erases the key, the saved copy and the session's activity.