ORRANGE
/docsLaunch wallet
ORRANGE / Product

How Privacy Works

Privacy comes from a strict separation of who owns what. The pool hides the transfer; the wallet owns the secrets; the dapp and the AI stay out.

STRK20’s privacy properties — shielded balances, encrypted notes, wallet-side discovery — come from the protocol and the connected privacy wallet. ORRANGE preserves them by never inserting itself between you and your secrets.

Who owns what

You (login / wallet)
│
├─ privacy wallet  ── viewing key, encrypted notes, discovery, proofs, signing
│
├─ ORRANGE dapp    ── UI, routing, portfolio aggregation (aggregates only)
│
└─ Hamster AI      ── sees only the aggregate portfolio needed for analysis
PartyOwnsNever sees
Privacy walletViewing key, encrypted notes, channel state, proofs, signing—
ORRANGE dappUI, routing, private-balance reads, portfolio aggregationViewing keys, encrypted notes, decrypted notes, private keys, nullifiers, proofs
Hamster AI—Everything except the aggregate portfolio summary sent for analysis

Hidden vs. observable

Within a STRK20 pool transfer:

  • Hidden: sender, recipient, amount, and token — inside the shared anonymity set.
  • Observable: that pool activity happened, and its timing. STRK20 is not “100% anonymous” and ORRANGE never claims it is.

The dapp boundary

  • Private balances come only from the wallet via wallet_strk20Balances (or the SDK lane’s discoverNotes). They are never reconstructed from local history.
  • The app has no mock balances, fake transactions, or fake confirmations. A transaction is only reported confirmed after on-chain reconciliation.
  • The app never falls back to a public ERC-20 transfer when privacy tooling is missing.

One-key registration

STRK20 uses a single viewing-key registration: set your viewing key once, and notes are created against it thereafter. The wallet transparently performs registration (viewing key + channel setup) on your first real STRK20 action — no separate dapp-facing register RPC exists.

What we do not use. The STRK20 SDK ships a separate shadow_account_anonymizer concept keyed by a dapp name. ORRANGE does not integrate it. Your private identity here is the STRK20 user identity (your derived account), not a Shadow Account. See Private Identity.

For the developer-focused threat model — what the AI can and cannot do, and how each threat is mitigated — see Security Model.