Confidentiality is a normal property of normal money.
A public ledger publishes your finances, permanently
[01]Transparency is what makes settlement assurance work, and we are not arguing against it. But the same property means a salary, a rent payment and a medical bill are readable by anyone who has one of your addresses — forever, retroactively, and increasingly well as analysis improves. Nobody chose that when they chose a faster rail.
How we address itA transfer can only reach an address that already exists
[02]Which excludes almost everyone you would actually want to pay. The usual answer is to ask them to install an app, write down a seed phrase and acquire gas first — a wall most people will not climb, and should not have to. A link is a rail everyone already has.
How we address itFour rules we hold ourselves to, including the expensive one.
Say what is shipped
Present tense for anything the docs document as working. Future tense, named explicitly, for anything that is not. A tense contradiction a reader finds by scrolling is fatal to a brand whose asset is being checkable.
No euphemisms
The lowest privacy level is called Public, not Standard, because Standard would hide from the reader that the transfer is fully visible. A euphemism here would cost more than it buys.
Publish the limits
Every claim we make sits next to an account of where it stops. It is the most expensive thing on the site to say, which is exactly why it is worth saying.
Numbers only where they are real
We publish 1.5% and Free. The HUSDB schedule is dynamic, so we show the shape of the curve and say so, rather than print a table that becomes a promise.
We say private, not magic.
Every other section on this site is an argument for the protocol. This one is the argument against it, written by us, at the same size as the rest.
Operational privacy, not cryptographic
This is privacy against on-chain observers, produced by pooling and routing. It is not a cryptographic guarantee. FHE-encrypted balances and an on-chain proof system are on the roadmap and are not shipped.
You are trusting a pool operator
You sign every deposit and withdrawal, and we never hold your keys — but your balance sits in a reserve Hood USDB operates and is recorded on our ledger, so withdrawals are processed by our backend rather than claimed from a contract. That is a trust assumption, and you should weigh it.
Off-chain adversaries are out of scope
Someone holding data that never touches the chain — an exchange record, a seized device, a legal order — is outside what routing can address. We would rather name the boundary than let you assume there is not one.
Public means public
The Public level is a normal token transfer and is fully visible, exactly like any other. We do not call it Standard, because that would be a euphemism, and a euphemism here would cost more than it buys.
Rails, reach, levels, then scale.
Phases rather than dated weeks. An undated week ages into a staleness signal the moment anyone reads it a month late, and staleness reads as abandonment.
Levels — in progress
Public, Partial and Full selectable per payment, relayer payouts for origin protection, and the fee flywheel — collection, buyback on Robinhood Chain DEXs, permanent burn.
- 01Privacy level per payment
- 02Protocol relayer v1
- 03FeeCollector + buyback
- 04HUSDB fee schedule
Contract: SOON. Network reference, endpoints and the full technical account live in the docs.