Why use this one

Not because the cryptography is unusual. It is deliberately ordinary. The difference is what gets disclosed.

Fixed denominations, Poseidon commitments, a Merkle tree, a Groth16 proof — this design has been examined for a decade. Innovation in this particular spot would be a warning, not a selling point. What varies between services is not the maths. It is how much they tell you.

Both anonymity-set numbers, not one

Every pool has two: the total number of deposits, and the number whose notes the operator does not already hold. The second is smaller and much less flattering, and it is the one that describes your actual exposure. Both are shown on the picker. A service quoting only the first is describing a pool that hides you from strangers while its operator watches over your shoulder.

What this site loads, including the awkward part

No external fonts and no CDN. There is one third-party script, Google Analytics, and a privacy tool that quietly runs analytics while implying otherwise is doing the thing it warns you about. So, plainly: Google is given your IP address and the time of your visit, and here that correlates with when you deposited. IP anonymisation is on, which truncates the address before storage without stopping the request. Your note, your amount and your destination are never part of it. Open the network tab and check — that is a verifiable claim, which is the only kind worth making. The full accounting is here.

The relayer exists for exactly one reason

A new destination wallet has no SOL and cannot pay for its own transaction, and funding it from your old wallet re-creates the link you came here to destroy. So a relayer broadcasts and takes its margin from the withdrawal — and because the recipient and the fee are bound into the proof, it can refuse to send but cannot reroute or overcharge.

The trusted setup is shown, not asserted

The proving key came out of a multi-party ceremony in which each contributor folds in randomness and publishes a fingerprint. The chain of fingerprints is on the Proof & trust tab, with its status stated plainly including where it is incomplete. A contribution nobody published is the operator's word, and it is marked as such rather than counted.

What is not claimed

Not "100% anonymous". Not "untraceable". Not "zero logs". The claim is narrow and testable: your deposit and your withdrawal cannot be linked on chain, and how much that is worth depends on the pool's depth and your patience. Anything beyond that is your operational discipline, not our product.

Compare with Tornado Cash or with an exchange.