What it protects

Protects against

• Anyone reading the chain learning your private balance or who you paid inside the pool.
• A counterparty seeing your other holdings after you pay them.
• Linking a deposit to a later exit by reading on-chain data alone, given a healthy crowd and good habits.

Does not protect against

• Your own links: exiting to your deposit address, mirrored amounts, funding gas from a known wallet.
• Network-level observers who see your IP address, or services you log into.
• A compromised device or wallet: whoever holds your keys holds your notes.
• A small pool. With few participants, timing and amounts can narrow things down.

Contract risk

An immutable contract cannot be patched. If a bug is found after launch, the only remedy is a new pool that users choose to move to. The code is open source and tested, and anyone can check a deployment against it, but no check removes this risk. Shroud only an amount whose loss you could carry.