# How privacy works

> Exactly what the public, your maker, the risk workers and you can each see.

Source: https://docs.rooq.trade/how-privacy-works

Rooq keeps your balance, positions and trades out of public view. It doesn't hide everything, and it isn't anonymity. This page says exactly where the line is.

## The short version

Your device holds your keys and makes your proofs. The chain only sees commitments, proofs and encrypted data. A proof shows that a trade follows the rules without showing the trade.

Pick someone below to see Rooq from where they stand.

| What | Public chain | You | Your maker | Risk workers | Coordinator | Relayer |
| --- | --- | --- | --- | --- | --- | --- |
| Shielding and unshielding | Can see. The wallet or recipient, the token, the amount and the time. | Can see. Full details. | Can see. The same public details as anyone else. | Can see. The same public details as anyone else. | Can see. The same public details as anyone else. | Can see. The same public details, for the unshields it submits. |
| Your private balance | Cannot see. Only commitments and encrypted data. | Can see. Every note, on your device. | Cannot see. No access. | Cannot see. No access. | Cannot see. No access. | Cannot see. No access. |
| Private transfers | Cannot see. Not the amount, the token or either person. | Can see. Yours, sent and received. | Cannot see. No access. | Cannot see. No access. | Cannot see. No access. | Partly. Its own fee note. Not the payment. |
| A position's size, side, entry and margin | Cannot see. Only that a position opened or changed in a market. | Can see. Full details. | Can see. The positions it is on the other side of. | Partly. What is needed to check health, against one-time addresses. | Partly. The terms of each lock it matches, against one-time addresses. | Cannot see. Only proofs and encrypted data. |
| Which maker backs a fill | Cannot see. Not published per fill. | Cannot see. A taker cannot see who backs its position. | Can see. Its own fills. | Partly. A one-time address, not a stable identity. | Partly. A one-time address, not a stable identity. | Cannot see. No access. |
| Funding on a position | Partly. The market's funding index each period. Never your own payment. | Can see. Owed, paid and any shortfall. | Can see. Its own positions. | Can see. The positions it can read. | Partly. The funding index and the positions it settles. | Cannot see. No access. |
| Liquidations | Partly. That a position in a market was liquidated, and the price. No amounts. | Can see. Your full receipt. | Can see. Its own positions. | Can see. The positions it liquidates. | Cannot see. No amounts from positions it did not settle. | Cannot see. Risk workers submit their own. |
| Spot swaps | Cannot see. Only that a pool changed. | Can see. Full details. | Cannot see. Spot does not use makers. | Partly. The swaps it fills, against one-time addresses. | Partly. The swaps it fills, against one-time addresses. | Cannot see. Only proofs and encrypted data. |
| Liquidity you provide | Cannot see. Only commitments and encrypted data. | Can see. Your share and history. | Cannot see. No access. | Partly. The pool's reserves and its pool records, not your wallet. | Partly. The pool's reserves and its pool records, not your wallet. | Cannot see. No access. |
| Pool reserves and open interest | Partly. Only rounded hourly totals that meet a privacy threshold. | Partly. Rounded quotes, and your own share. | Partly. What it needs to back its fills. | Can see. Full figures. | Can see. Full figures. | Cannot see. No access. |
| Prices, market rules and contract code | Can see. Everything. | Can see. Everything. | Can see. Everything. | Can see. Everything. | Can see. Everything. | Can see. Everything. |

## What can still link you

Some things can't be hidden, and some patterns give you away.

- **Moving in and out is public.** Shielding and unshielding show the address, token, amount and time.
- **Distinctive amounts.** Shielding 1,337.42 USDG and unshielding the same amount later looks like one person.
- **Fast round trips.** Shielding and unshielding close together links the two.
- **Thin markets.** In a market with few trades, public totals and timing can reveal a single trade. A funding index with one position open reveals that position's direction.
- **Address reuse.** Shielding and unshielding with the same wallet ties them together.
- **Gas funding.** Paying gas for an unshield from your connected wallet links it publicly.
- **Your device.** Rooq can't protect you if your device or browser is compromised.
- **Your network.** The services you connect to can see your IP address. A rate limit holds it in memory for a minute and Rooq's services don't log it. If that matters to you, use a VPN or Tor.

Rooq never falls back to public execution. If proving fails or a service is down, your action stops or refunds. It doesn't quietly go public.

## Published market data

Rooq publishes no trade feed. There's no list of individual trades, sizes or accounts.

Market totals are published per hour and rounded to two significant figures. An hour is only published if it has at least 10 fills, at least 2 makers and no single fill above 25% of its volume. An hour that fails rolls into the next one.

This limits what a release can say about one trade. It can't stop a determined person who splits orders across many accounts, because Rooq can't tell who is behind a note.

## Who the services are

- **Coordinator.** Matches locks and fills spot requests. It can only do what your signed limits allow.
- **Risk workers.** Two services with separate keys. They read positions so liquidation works when you're offline.
- **Relayer.** Pays gas and submits proofs. It holds no secrets and can't sign for you.

These services can see what's listed above. If one of them keeps or leaks what it has read, proofs can't undo that, and changing keys later can't erase what it learned.

None of them can move your money outside the rules. The contracts and proofs check custody and math, even if every service were dishonest. A service can still delay or refuse to act. The testnet price relay is a separate case. It can set any price within its bounds, and a bad price can cause real losses in a position.

## How to verify it

Anyone can check that an action was accepted against the [public contracts](https://docs.rooq.trade/contracts). The explorer shows that a proof was accepted. It doesn't show your trade, and your receipt in the app is what holds the details.

Rooq has not been audited. This page describes the design and the code.