# Privacy boundaries

The collection experiment publishes its owner, supplier claim public key, token, funded amount, deadline, and any collected note ID and amount. Funding and recovery use ordinary public token transfers. Collection is intended to use STRK20 note ownership privacy, which VOW has not yet demonstrated through a real wallet.

A controlled mandate and one reservation now exist on mainnet. Mandate creation published the 16-slot commitment root with the owner, operator key, token and expiry. Reserving opened exactly one leaf: its slot, supplier claim public key, cap, deadlines, purchase commitment and opening salt travelled in public calldata, and the reserved amount, leaf hash and supplier key appeared in the event. The other permission and padding leaves were not published by VOW; they remain in the local encrypted material. This observation does not prove protection against endpoint compromise or an authorized holder disclosing plaintext.

SDK claim signing takes a local key and returns a signature. The library contains no logging or network transmission of signing inputs. The capability probe requests wallet_supportedWalletApi without parameters. It preserves only version strings and bounded numeric error codes. The previous balance probe was removed because an empty token list can request all shielded balances. It does not request account access, signatures, or transactions; wallet implementations may still request a connection.

The local diagnostic reads wallet name, ID, application version, and provider transport. It does not inspect account arrays or selected addresses. Results are displayed in the page and are not saved or uploaded. Its server has a fixed static-file allowlist, no write endpoints, no request logs, and a Content Security Policy that disables page network connections. Provider discovery uses a bundled pinned Wallet Standard dependency served locally.

Prepared pool calldata and proofs may contain sensitive metadata. Do not persist actual wallet payloads, viewing keys, secrets, or permission witnesses to test fixtures, URLs, telemetry, or public evidence. Current fixtures are synthetic. The public pool ABI and block observation contain no supplier secret material.

The decoder checks destination binding and permitted transfer fields; it does not verify a proof, identify encrypted note owners, authenticate RPC responses, or establish that a note was credited. These require wallet and chain evidence. A compromised active browser can expose local secrets despite encryption at rest.

The collection review page permits public reads to the fixed Cartridge RPC endpoint. That provider sees the queried public contracts and client IP address. The manifest includes a public recipient address; it is displayed locally and passed to the wallet, never written to the server. Wallet proof preparation can communicate with wallet/prover infrastructure under that wallet's policies. The page requests no private balances, account list, viewing key, or private signing key. Supplier signature r/s are public authorizations; prepared proofs and calldata remain potentially sensitive and are not displayed or exported by the page. Discarding clears application references; it cannot guarantee physical memory erasure or undo data already shared with the wallet's services.

The separate supplier tool generates and decrypts claim keys inside its browser tab. Its loopback server serves only fixed assets, rejects writes, and uses a separate origin from the collection page with `connect-src 'none'`, opener isolation, no framing and no caching. It contains no wallet discovery, upload endpoint, telemetry or browser-storage persistence. The downloaded backup contains encrypted private-key material and a public key; the file remains on the user's device after the page locks. Keep it out of screenshots, chat, fixtures and external browser tests.

The app clears password fields, overwrites owned key-byte buffers on lock, and drops references after signing, manual lock, inactivity or page exit. JavaScript strings, browser internals, cryptographic libraries and password managers may retain copies; physical memory erasure is not guaranteed. Encryption at rest does not protect an active compromised browser, extension or local server. Only an empty-state browser test was authorized and run for this tool; secret-handling tests use synthetic local inputs.

Password visibility is opt-in per field through its eye button. Revealed text stays within that input; clearing, locking or starting a key operation masks it again. Length and match feedback display counts and validation results only.

Deployment preflight sends the explicitly provided public owner address to the fixed RPC to read account deployment state and public STRK balance. It requests no shielded balances and stores no keys. The separate activation-details page requests connection to the selected public wallet account and its deployment metadata only after a button click. The returned address must match the user-provided expected account. Constructor calldata may identify public account signers or guardians and is displayed only after the expected address is verified. Optional signature data is excluded without reading it. This page has no RPC permission or upload endpoint; the user chooses whether to share its public result.

Unsigned activation estimation sends the provided public account class, salt and constructor to the RPC, with an empty signature. Combined declaration estimation additionally requires the full compiled Sierra program and ABI; the local preview CLI constructs that payload without sending it. No supplier private key or backup is needed for either request.

The receipt CLI discloses the queried public transaction hash and contract addresses to Cartridge, along with normal network metadata. Expected note ID and amount are compared locally against public events. Raw receipt/trace responses remain in process memory and are not printed or persisted by the verifier. Output contains the transaction/block hashes and verification states, without revert text, signatures or proof payloads. The collection submission journal records its review digest, state, chain/vault/reservation scope, public note ID and public transaction hashes in same-origin storage before and after dispatch. Other scripts on that origin can read those public identifiers. No proof, calldata, signature, password or private key is written to the journal.

The local `/claim/:reservationId` path puts only the already-public reservation identifier in its URL. It reads the pinned VowVault, reservation, token balance, allowance, pool state and class hashes before enabling wallet or supplier-signature controls. The `/verify/:txHash` path needs no wallet and discloses only the public transaction hash and pinned public deployment fields to Cartridge. The preloaded hash is a public unrelated negative control. Supplier signature values and prepared proof material are held in memory; only the public recovery journal survives a dispatch attempt.

Deployment preflight reads the owner's public privacy-registration key from the pool at the selected block. This reveals whether a public key is recorded there; it does not request viewing-key material, encrypted private keys, notes or shielded balances.

The deployment review page may read an explicitly provisioned public draft, compiled public contract artifact and fee ceilings from its loopback server. Its execution section connects the selected public wallet account and sends public chain queries to Cartridge only after a user action. Before dispatch, it stores the stage, owner, nonce, reviewed fee ceiling and review digest in same-origin browser storage; it may later add the public transaction hash, canonical block and reconciliation state. It stores no contract class, constructor, wallet signature, private key, password, backup, or proof. Clearing storage or changing origins removes the page's retry guard, so unresolved transactions must be reconciled from the retained public hash before another attempt. Exported collection configuration contains public terms.