Private transfers on Robinhood Chain
Send. Swap. Hold. Privately.
STEALTHOS is a shielded pool on Robinhood Chain, the relayer network that submits your transactions, a hardened phone OS that generates proofs on-device over Tor, and the phone that ships with it. One token runs all of it.
chain Robinhood Chain · 4663
gas ETH
dex Uniswap v4
admin keys none
upgrades none
Total shielded—live after mainnet · Oct 2026
Deposits—live after mainnet · Oct 2026
Relayers online—registry opens Dec 2026
Notes in tree—live after mainnet · Oct 2026
Contracts · Oct 2026In progress
Wallet app · Nov 2026In progress
Token · Nov 2026Scheduled
Relayers · Dec 2026Scheduled
Node installer · Dec 2026Scheduled
Device · Q1 2027Q1 2027
The shielded pool
Deposit ETH into a pool. Withdraw to any fresh address through a relayer with a zero-knowledge proof, so nothing on-chain connects the exit to the entry.
Private by default
Every deposit becomes an encrypted note. Withdrawals prove ownership without revealing which note is spent, and land at any address through a relayer.
Selective disclosure
You hold a viewing key. Share it with an accountant, a counterparty, or nobody. Disclose a single transaction without opening your whole history.
Association sets
Withdraw with a proof that your funds belong to a clean set of deposits, without saying which one. Compliance without surveillance, the Privacy Pools model.
Proven circuits
Built on the audited Privacy Pools circuits and their 514-contributor trusted setup, reused unchanged. No new cryptography, no custom circuits.
Non-custodial. No admin.
No owner, no pause switch, no upgrade path. The contracts do exactly what the verified source says, forever. Deposits are capped per transaction by design.
Native to Robinhood Chain
ETH gas, Uniswap v4 liquidity, and the first shielded pool on the chain. Swap in and out of privacy without leaving the network.
One transaction, end to end
Everything sensitive happens on your device. The chain only ever sees a proof.
01 DEPOSITSend funds to the pool. A secret note is created on your device and encrypted to your keys.
02 SYNCYour wallet downloads the note tree from an indexer over Tor and decrypts what is yours, locally.
03 PROVEA zero-knowledge proof is generated on the phone. Secrets are unlocked by the hardware security module only for that moment.
04 RELAYA relayer submits the proof and pays gas, and is paid inside the withdrawal. Your address never touches the transaction.
05 RECEIVEFunds land at a fresh address. Nothing links it to the deposit.
Watch a withdrawal
A shielded withdrawal, start to finish, as the phone and the network see it. Simulated on this page; the real counters go live with the contracts in October.
phone view Simulation
STEALTHOS● Tor
Shielded balance0.31 ETH
Ready
3 notes synced · relayers: 4 online
Withdraw 0.1 ETH
network view Simulation
running
Nodes
Two kinds of infrastructure keep the pool usable. Anyone can run either, on their own server, in ten minutes.
Relayers Dec 2026
Submit withdrawals on behalf of users and pay the gas. Earn a fee on every relayed transaction, paid inside the withdrawal.
- Anyone can run one; the pool accepts any submitter
- Fee is bound inside the proof: a relayer cannot alter it
- Optional on-chain listing with a small stake
- Reachable over Tor as an onion service
Indexers Dec 2026
Serve the encrypted note tree so wallets can sync without asking anyone which notes are theirs.
- Whole-tree snapshots, no per-note queries
- Onion service by default
- Runs alongside a relayer on the same box
1-click deploy
Paste one line on any server you own, or paste the cloud-init into your own hosting account. The node is yours from the first second: your provider, your keys, your logs. Same from the site, same from the phone.
- Stack
- docker · relayer · indexer · tor
- Requirements
- 2 vCPU, 4 GB RAM, 40 GB disk
- Cost
- Your VPS bill, from about $6 a month
- Ownership
- Yours. Nothing is provisioned or operated for you.
relayer network Simulation
relayerindexerpeer
directory Simulation
| relayer | region | fee | relayed | up |
|---|---|---|---|---|
| r1.onion | eu-west | 0.40% | 1,284 | 99.7% |
| r2.onion | us-east | 0.30% | 2,019 | 99.9% |
| r3.onion | ap-south | 0.50% | 743 | 98.8% |
| r4.onion | eu-north | 0.35% | 956 | 99.4% |
| r5.onion | sa-east | 0.45% | 312 | 96.1% |
| idx1.onion | eu-west | — | tree 41,208 | 99.9% |
StealthOS
A locked-down setup on GrapheneOS, a distinct project we are not affiliated with. The wallet runs in its own profile where every byte of traffic goes over Tor or nowhere. Proofs are generated on the device.
On-device proving
Zero-knowledge proofs are generated locally in seconds. No remote prover ever sees your notes.
Hardware-gated keys
Your seed is wrapped by a key that never leaves the phone's hardware security module. Using it requires the device and your unlock.
Tor-forced wallet
Wallet, indexer sync, and relayer traffic are pinned to Tor with always-on VPN lockdown. If Tor is down, the wallet is offline, not exposed.
Verified boot, attested
Stock GrapheneOS with hardware attestation intact. Signed app builds with published checksums. You can verify what is running.
No Google, no telemetry
Sandboxed Play services are optional and off by default. Nothing phones home.
Deploy a node 2027
The same one-line installer, opened from the phone. Your server, your keys.
The phone Q1 2027
A Pixel 10 Pro, set up with StealthOS, sealed and shipped. The newest Pixel with full GrapheneOS support.
STEALTHOS● Tor
Shielded balance0.31 ETH
Ready
3 notes synced · relayers: 4 online
Withdraw 0.1 ETH
- Hardware
- Google Pixel 10 Pro
- OS
- GrapheneOS with the StealthOS profile and wallet
- Secure element
- Titan M2, hardware-gated seed
- Network
- Tor enforced for wallet traffic
- Wallet
- Preinstalled, proofs on-device
- Support
- GrapheneOS updates until 2032
- Payment
- ETH, with a discount in the token
- Delivery
- Target 30 days from order
Pre-orders open when devices are in stock, sold by a registered company with a 14-day return right. No deposits are taken before that.
Token
One token. It lists a relayer, discounts the phone, and carries the project. It never touches the pool.
| Use | What it does | Who pays |
|---|---|---|
| Relayer listing | A small stake lists a relayer in the on-chain directory. | Node operators |
| Phone discount | Pay part of the device price in the token at a discount. | Buyers |
| Liquidity | Locked permanently at launch. LP fees accrue to the locked position. | Traders |
| Pool fees | None. Relayers are paid in ETH inside each withdrawal. The token takes nothing from the pool. | Nobody |
Chain
Robinhood Chain, Uniswap v4 pool, ETH-quoted.
Liquidity
Seeded at launch and locked permanently. Founder's first buy disclosed at launch.
Launch · Nov 2026
Announced from the dev wallet. Contract address published here first.
Architecture
Five layers, each depending on the one before it. Nothing decorative.
Timeline
Contracts and the wallet first. The token when there is something real behind it. Devices when they are in hand.
Sep 2026done
Design locked
Architecture, fork selection, chain verification, and the security and legal review behind every choice on this page.
architecturethreat modelfork choice
Oct 2026in progress
Contracts on Robinhood Chain
Shielded pool deployed and verified, deposits capped per transaction. Deposit, prove, and withdraw through a relayer from the browser. First relayer and indexer online.
pool contractsverified sourceweb walletrelayer #1
Nov 2026scheduled
Wallet app and token
Android wallet with on-device proving and Tor-forced traffic. Token launches on Robinhood Chain with permanently locked liquidity.
android appon-device proofstoken launch
Dec 2026scheduled
Relayer directory and node installer
On-chain relayer directory. One-line node installer and cloud-init page. Per-transaction disclosure receipts in the wallet.
relayer directorynode installerdisclosure receiptsindexer network
Q1 2027scheduled
The phone
Pixel 10 Pro devices with the StealthOS setup, sold from stock with a token discount, delivery target 30 days from order. Association-set withdrawals.
device pre-ordersassociation sets
Straight answers
Is this custodial?
No. Funds sit in a contract with no owner. Only a valid proof from your keys can move them. There is nobody to freeze, pause, or upgrade it.
Can I prove where my money came from?
Yes. You can disclose any single transaction of yours to anyone you choose, verifiably, without opening the rest. Association-set withdrawals are on the roadmap.
Do I need the phone?
No. The pool works from any browser and the wallet app runs on any Android. The phone is the hardened, pre-configured way to use it.
What does this not protect against?
Timing and amount correlation if you withdraw exactly what you deposited right after depositing. A small number of other users early on. A compromised device. Robinhood Chain itself can filter transactions to any address. Privacy is a practice, not a button.
Who runs the relayers?
Anyone. The project publishes the installer and the directory contract. It does not operate the network, and takes no fee from it.
Is the code audited?
The circuits and their trusted setup are the audited Privacy Pools originals, reused unchanged. The contract changes around them are published and verified but not separately audited. This is a reference deployment with a per-transaction deposit cap. Do not deposit more than you can afford to lose.