Learn › Module 4 of 6

Privacy

The ledger is public. Privacy is not a feature you switch on: it is a set of habits, plus knowing exactly what leaves your phone.

1. What the ledger reveals

Every transaction is public and permanent: amounts, addresses, timing, and the graph of which address paid which. What is not in the ledger is your identity — addresses are pseudonyms, not names.

The practical consequence: privacy is broken by linking, not by the ledger itself. The moment an address is tied to you (an exchange withdrawal, a public donation page, a payment to a merchant who knows you, a message where you pasted it), everything connected to it becomes linkable too.

2. Address reuse: the real problem

Your wallet can generate practically unlimited addresses. It should: one fresh address per payment received.

Reusing one address is like using the same statement number for your salary, your rent and your donations:

anyone who learns that address can see your whole income and spending history with it;
a merchant, a client or a fundraiser can total up everything you ever received there;
the link survives forever — there is no "clean up" transaction.

In this app, "Receive" always proposes a fresh address. Accept that proposal: it costs nothing.

3. Change addresses

When you pay, your change returns to a new address of your own wallet (module 2). That is a privacy feature: if change went back to the address you were paid on, every payment would chain your balance together in public.

Seeing "receive" and "change" branches in the address list is therefore normal. The change branch is not a second wallet and does not mean you have double funds.

4. What this app sends, and to whom

The app has no accounts, no analytics, no tracking SDKs and no telemetry. Your keys never leave the device. But to show a balance it must ask somebody about the chain:

Primary source: mempool.guide, a public Esplora-compatible API. Requests include the addresses or transaction IDs the app is looking up; the provider necessarily sees your IP address and the timing.
Optional community mirrors: if the primary is unavailable, the app may fall back to two community Esplora-compatible mirrors (mempool.kilombino.com, mempool.maveth.ca).
Broadcast: sending a transaction means handing it to one of those nodes so it reaches the network.
Optional automatic price: if you enable it in Settings, the app reads the last XBT/USDC trade from neoxa.exchange (NeoXEX) on demand. When the value currency is not USD it also reads the USDT exchange rates from api.coinbase.com. It never polls and can be turned off in Settings.

In Settings → Tools → Explorer mirrors you can turn the fallback off: then only the primary source is used, and no address or transaction data goes to a third-party mirror. On the web/PWA build the mirrors are mandatory (the primary API blocks browser requests), which is one more reason to use the mobile app for real funds.

What is never sent: your recovery phrase, your password, your private keys, your xpub (unless you explicitly export or share it), a device identifier, or usage statistics.

5. The xpub is a privacy key

An xpub cannot spend — and that is exactly what makes people careless with it. With the xpub, anyone can derive all your addresses, watch your balance live, and link every payment you will ever receive in that account.

Share it only with software or people you would show your full bank statement to.

6. Raising the bar

A fresh address per payment — the single highest-value habit.
Turn off the mirrors if you prefer one provider instead of three.
Use a VPN so the API provider does not learn your home IP.
Run your own node if you want to stop asking anyone at all (see the node page).
Use coin control to avoid accidentally merging UTXOs from different contexts in one transaction — merging is a public statement that they belong to the same person.
Do not post addresses or transaction IDs in public chats, and never post your xpub.

Takeaway — The ledger is public, so privacy comes from not linking your addresses. Use a fresh address per payment, let change go to the internal branch, and know the exact list of servers the app talks to (one primary API, plus two optional mirrors you can disable).

7. Check yourself

You published one address on your website. What does a stranger learn from it over a year?
Which switch in the app reduces the number of servers that see your addresses?
Why is giving someone your xpub a privacy decision rather than a spending risk?