The privacy model

The promiseCopy Anchor Link

The prices are public. You aren't. One shielded deposit becomes private chips, blind-signed so the mint can't tell which deposit they came from. Every request travels through an Oblivious HTTP relay: the relay sees your IP but only encrypted bytes, and the operator sees the trade but never your IP. There is no account and no sign-in.

Who sees whatCopy Anchor Link

How the design gets thereCopy Anchor Link

• Chips, blind-signed. Your deposit buys chips: bearer tokens the mint signs without seeing them (Chaumian e-cash, Cashu's BDHKE on secp256k1). Each signature comes with a DLEQ proof against the one published set of chip keys, so the mint can't mark a chip to recognise it later, and your app refuses proceeds that aren't paid in the standard split. When you trade, you spend chips the mint has never seen unblinded, so it can't tell which deposit paid.
• Oblivious HTTP for every request. Deposits, trades, closes, redemptions and withdrawals are each sealed to the operator's gateway key (RFC 9458, HPKE with X25519, HKDF-SHA256 and AES-128-GCM). The key is in the signed bundle, so everyone encrypts to the same one, and it changes every hour; a device that slept through a change gets the new key from the next bundle and sends the same request once more. The relay builds a fresh request carrying only its content type, so no header of yours, and not your IP, reaches the operator. Its Worker keeps no logs. Requests and answers are padded to a few fixed sizes, so their length says nothing about the call or how many chips it carries.
• The same files for everyone. Every visit loads the same signed files for both networks, on the same minute clock, whichever one you use. The asset and Window you look at live in the URL fragment (/trade#BTC/5m), which browsers never send.
• Prices through Kakure's relay. Your browser never connects to an exchange. The relay streams every symbol to every visitor and serves every symbol's candles in one response, so it can't tell which one you chart.
• Standard sizes and your own timing. Stakes snap to the chip ladder (1, 2 or 5 × 10^k), so a stake never encodes your balance and is paid in exact chips without change. Each position is redeemed at its own random time, 20 seconds to 3 minutes after its Window, and calls go one at a time.
• Volume in groups of three. A Window's trade count and volume count only whole groups of three trades, never one trade's size, and a partial close never shows in it.
• Withdrawals split and spread. A withdrawal leaves as standard 1, 2 or 5 × 10^k notes, each its own transaction at its own random time, so an exchange that receives them can't match them to a trade.
• The house's books, hourly. The signed bundle states the chips outstanding and the most the open positions could pay, taken once an hour and rounded up to the per-side cap, so no single trade, deposit or withdrawal shows in the change.

What Kakure can't hideCopy Anchor Link

1. Timing. A trade placed right after a deposit, or a withdrawal right after a win, can be matched by time. Chips come in standard amounts, stakes in standard sizes, and redeems and withdrawals at random times; spreading your own activity out does the rest.
2. Linking trades. Each trade spends chips the mint can't trace, but the operator still sees every trade's Window, side, stake and time, so amounts and timing can hint that two trades share an owner, more so while few people trade.
3. Kakure runs both the relay and the operator. Oblivious HTTP is built for two separate parties, so keeping your IP apart from your trades rests on Kakure not combining the two. Using Tor keeps your IP from both.
4. Custody and the house's solvency are trusted. The hourly liability statement is the check.
5. Position certificates aren't blinded, so the operator links a position's open to its close or redemption. That's the same anonymous trade, so it reveals nothing new.
6. The n−1 case. Volume moves in steps of at least three trades; someone who places two trades of a group can work out the third's stake.
7. The per-side cap. A trade the cap refuses tells whoever placed it which quarter of the cap that side of the Window has reached.
8. Signed reports. Prices and outcomes are signed by the operator, but each print is an exchange's public 1-minute candle, so anyone can fetch them again and recompute.
9. The chain source. The operator reads the chain from public light-wallet servers over Tor, so it relies on them to serve it honestly.
10. A small crowd. While few people use Kakure, the crowd you hide among is small.
11. Harvest now, decrypt later. Oblivious HTTP and Zcash's note encryption use elliptic-curve key exchange, so traffic and transactions recorded today could be read after a future break of that cryptography.
12. The gateway key. The operator's Oblivious HTTP key changes every hour and the old one is deleted ten minutes later (RFC 9458 §6.6). If the operator were ever broken into, requests recorded on the way in the last hour or so could be read, never older ones. In those ten minutes, a request's one-byte key id also shows whether its device had fetched the new key yet.
13. What the operator keeps. Deposit records and spent-chip fingerprints stay for good: they stop a deposit minting twice or a chip spending twice. A withdrawal's address and amount go a week after it's paid, and an address already paid can't be used again.
14. The arcade isn't sealed. The site sees your arcade calls (nickname and scores) with your IP, though it keeps no logs; the arcade service never sees the IP. A nickname is public, so pick one that doesn't name you.
15. Sign in with X. Optional. It names you on the boards with your X handle, so your runs, duels and published calls sit under a name the world can tie to you. The arcade keeps the handle and a salted hash of your X id, never a token.
16. Publishing a call. The Bets board is opt-in, one paid call at a time. The operator blind-signs a receipt it can't recognise later (NUT-00 with a NUT-12 proof), so neither it nor the arcade can lead the board back to your trade, and the operator never learns your nickname. If you publish the moment the receipt is signed, Kakure could match the two by time, as it could any sealed request to the visit that sent it. The board's weekly changes, read against the public outcomes, can narrow down which Windows a nickname called while few people trade. Turning it off takes the call down at the week's turn; anyone who saw the board may remember it.
17. This browser. It keeps your trade settings (stake size, trail, starred markets), your arcade key, nickname and runs and Practice's tally, and its history keeps the pages you opened. Lucky's draws, like your chips and positions, are kept encrypted in its vault. Forget this device clears the app's part.
18. Your side. Your funding history and your wallet's server are outside Kakure's control.