Privacy model · the core of Nulvo
Every field. Who sees it.
This table is what Nulvo is. It lists every field of a payment and, for each way of paying, where that field ends up. Payer, recipient, token, amount and time are public in every mode. What Nulvo keeps off chain is what the payment was for.
Three ways to pay
The modes
| Mode | How it works |
|---|---|
| Plain transfer | A wallet sends HYPE or USDC straight to an address. Shown for comparison: this is what any transfer reveals. |
| Nulvo link | The recipient makes a link in the browser. Nothing is on chain until the payer pays it with payLink(); then the payment and a commitment hash appear. |
| Nulvo request | The recipient opens the request on chain first, so its status (open, paid, cancelled, expired) can be read by anyone. Its terms are public from that moment. |
Field by field
Where each field ends up
- Public on chain
- Public before payment
- Hash on chain only
- Link and receipt only
- Not recorded
| Field | Plain transfer | Nulvo link | Nulvo request | Nulvo's server |
|---|---|---|---|---|
| Payer (sender) addressThe address that signs the payment is always visible. Nulvo does not hide who paid. | Public on chain | Public on chain | Public on chain | Not stored. Your browser may ask the site's relay for your HYPE balance; the relay forwards the read and keeps no log of it. |
| Recipient addressThe book forwards the money to the recipient in the same transaction, so the transfer shows the recipient. | Public on chain | Public on chain | Public before payment | Not stored. |
| AmountNulvo does not hide amounts today. Amount hiding needs a shielded pool: planned, not built. | Public on chain | Public on chain | Public before payment | Not stored. |
| TokenHYPE (native) or USDC on Elysium. | Public on chain | Public on chain | Public before payment | Not stored. |
| Time of paymentEvery block has a timestamp. An on-chain request also shows when it was opened. | Public on chain | Public on chain | Public on chain | Not stored. |
| Memo (what it is for)Anyone you give the link or the receipt to can read the memo. A plain transfer has no memo unless you put text in the transaction data, which makes it public forever. | Not recorded | Link and receipt only | Link and receipt only | Never sent. It is in the part of the link after #, which browsers do not send to any server. |
| Reference (invoice number, order id)Same as the memo. | Not recorded | Link and receipt only | Link and receipt only | Never sent (after # in the link). |
| Commitment hashkeccak256 of a 32-byte random salt and the details. It proves the details later without showing them now. | Not recorded | Hash on chain only | Hash on chain only | Not stored. |
| SaltRevealed only when you share a receipt for that one payment. Each link has its own salt, so one receipt opens nothing else. | Not recorded | Link and receipt only | Link and receipt only | Never sent. |
| Link id or request idA link id is a hash of the link's terms; it appears when the link is paid. | Not recorded | Public on chain | Public before payment | Not stored. The verify page reads it through the relay. |
| ExpiryA link carries its expiry in the payment call; a request publishes it when opened. | Not recorded | Public on chain | Public before payment | Not stored. |
| That an unpaid request existsAn unpaid link leaves no trace on chain. An open request is visible to anyone reading the book. | Not recorded | Not recorded | Public before payment | Not stored. |
| Your other paymentsThe same address links all its payments together. A receipt opens one payment's details, but your address history is public anyway. | Public on chain | Public on chain | Public on chain | Not stored. |
Anyone who holds a link or a receipt can read its memo. Share a link with the payer only.
Whom you still trust
No mode removes these
| Your wallet | It builds and signs the transaction, so it sees every field, and it talks to its own RPC provider. |
| The RPC node your wallet uses | It receives the signed transaction before the chain does, along with your IP address. |
| The Elysium sequencer | Elysium is an Arbitrum Orbit chain: one sequencer orders transactions and sees them before they are final. |
| Whoever holds the link or the receipt | They can read the memo, the reference and the salt. Share a link with the payer only. |
| This website and its host | The code that builds links runs in your browser and comes from this site. The host keeps ordinary request logs (IP, path, time); the path never contains link details, because they sit after #. |
| The site's chain relay | Reads go through /api/rpc. It sees which address or id is read and from which network, keeps a rate-limit counter per network for ten minutes, and stores nothing else. |
Not claimed
What Nulvo does not do
- Not anonymous: payer and recipient addresses are public on chain.
- Amounts are public. Nothing here hides an amount.
- Not a mixer and not a shielded pool. Those are planned research, not features.
- No custody: the book forwards every payment in the same transaction and never keeps a balance.
- New code: the contract has its own tests and a written self-review, and has not had an independent security review. Use small amounts.