Your private balance is stored as a Pedersen commitment: a point on a curve, computed as C = v·G + r·H, where v is your amount and r is a random blinding factor. Anyone can read C off the ledger. Nobody can work backwards from it. For any point on the chain, every possible amount has a blinding factor that would have produced exactly that point, so it rules nothing out.

The (v, r) that opens a commitment never touches the chain. Your device derives it from your recovery phrase and keeps it locally. That pair is the difference between a balance being yours to spend and yours to look at.

Add two commitments and you get a commitment to the sum. So the contract credits deposits, debits transfers and folds one balance into another without ever learning a single amount. That one property is what makes the whole thing possible, and it is also why yield and swapping cannot live here: those need multiplication and comparison, and commitments only add.

Every private transfer carries a cryptographic proof, generated from one of six circuits, that establishes all of this without revealing any of it:

Generated locally in under half a second. The proving system and its cryptographic reference data ship inside the extension, so nothing is fetched and nothing is uploaded. There is no server of ours that could do this instead.

It arrives at a verifier contract holding six verification keys, one per circuit, written in when the contract was created and impossible to replace afterwards. No partial state, no admin override, nobody in the path.

The same transaction carries it encrypted to the recipient, so they can spend it, and to the auditor key each side has bound, so a business can produce a reviewable record. The circuit enforces both: a transfer cannot be built with either one missing or malformed.

In a pool you're hidden because you look like everyone else in it. A thin crowd, an unusual amount, or predictable timing narrows it back down to you. Hiding how much gives every user the same guarantee from day one, with no crowd to depend on.

A pool needs a gatekeeper to decide who's let in and to freeze bad actors, which means someone can freeze you. It usually needs a relayer to submit transactions for you, which means someone sees and could block your payments. Pocket has neither. You sign your own transactions, and nobody stands between you and the chain.

Think of a bank statement, not a numbered account. For payroll, a treasury, or a supplier, the sensitive thing is how much, and the counterparty has to be on the record, because you can't run a business on untraceable money. And your amounts are readable by no one but you, unless you hand over the key yourself. You are your own auditor.

Opening a private balance is public. So is the amount you move in or out, and the account that pays the fee. We publish the full list, because privacy you can verify beats privacy you’re asked to believe.